+ 6.2 Auth, xsrf