Added the :authentication event to the login options, otherwise the csrf cleanup isn't run

@martijnrusschen