SESSION-LOGIN: Ensure this handles sw_token request param ref. CSRF check.