v2.9 CSRF/h switch-over; auth chaining /d