before auth|csrf; after log