Episode 12 -- Setting up sessions and tokens to protect against CSRF.