There are some similarities between "auth_mode == 'session':" and what I wanted to do with HP Alm. I probably could have re-used that - except the following code assumed I needed to pass a CSRF token. This is was SDE needs - but not me. Maybe we want to refactor this a bit and remove my "if auth_mode == 'cookie'" bit.