system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
"""Authentication module for the swift-sharing-request."""

# The authentication is done via requests signed with a pre-whitelisted token.
# This is done to prevent invalid usage. New tokens can be created either
# manually on the platform that's running the software, or by
# pre-authenticating via Openstack Keystone.

# Authentication engine is written as an aiohttp middleware function.


import os
import typing
import hmac
import time
import logging
import secrets

import aiohttp.web
from asyncpg import InterfaceError

from .db import handle_dropped_connection


AiohttpHandler = typing.Callable[
    [aiohttp.web.Request],
    typing.Coroutine[
        typing.Awaitable,
        typing.Any,
        aiohttp.web.Response
    ]
]


LOGGER = logging.getLogger("swift_x_account_sharing.auth")
LOGGER.setLevel(os.environ.get('LOG_LEVEL', 'INFO'))


async def read_in_keys(
        app: aiohttp.web.Application
) -> None:
    """Read in keys to the application."""
    keys = os.environ.get("SWIFT_UI_API_AUTH_TOKENS", None)
    app["tokens"] = keys.split(",") if keys is not None else []
    if app["tokens"]:
        app["tokens"] = [
            token.encode("utf-8") for token in app["tokens"]
        ]


async def test_signature(
        tokens: typing.List[bytes],
        signature: str,
        message: str,
        validity: str,
) -> None:
    """Validate signature against the given tokens."""
    # Check signature expiration
    if int(validity) < time.time():
        LOGGER.debug(f"Signature validity expired: {validity}")
        raise aiohttp.web.HTTPUnauthorized(
            reason="Signature validity expired"
        )
    byte_message = message.encode("utf-8")
    for token in tokens:
        digest = hmac.new(
            token,
            byte_message,
            digestmod="sha256"
        ).hexdigest()
        if secrets.compare_digest(digest, signature):
            return
    LOGGER.debug(f"Missing valid query signature for signature {signature}")
    raise aiohttp.web.HTTPUnauthorized(
        reason="Missing valid query signature"
    )


@aiohttp.web.middleware
async def handle_validate_authentication(
        request: aiohttp.web.Request,
        handler: AiohttpHandler,
) -> aiohttp.web.Response:
    """Handle the authentication of a response as a middleware function."""
    try:
        signature = request.query["signature"]
        validity = request.query["valid"]
        path = request.url.path
    except KeyError:
        LOGGER.debug("Query string missing validity or signature")
        raise aiohttp.web.HTTPClientError(
            reason="Query string missing validity or signature"
        )

    project: typing.Union[None, str]
    project_tokens = []
    try:
        project = request.match_info["project"]
    except KeyError:
        try:
            project = request.match_info["owner"]
        except KeyError:
            try:
                project = request.match_info["user"]
            except KeyError:
                project = None
    finally:
        if project:
            try:
                project_tokens = [
                    rec["token"].encode("utf-8")
                    for rec in await request.app["db_conn"].get_tokens(project)
                ]
            except InterfaceError:
                handle_dropped_connection(request)
        else:
            if request.path != "/health":
                LOGGER.debug(f"No project ID found in request {request}")
                raise aiohttp.web.HTTPUnauthorized(
                    reason="No project ID in request"
                )

    await test_signature(
        request.app["tokens"] + project_tokens,
        signature,
        validity + path,
        validity
    )

    return await handler(request)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  B) CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
  C) CWE-117: Improper Output Neutralization for Logs
  D) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  E) CWE-502: Deserialization of Untrusted Data
  F) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Answer: C