specify connect version
tweak
save session on disconnect too
add a test for csrf