Or something like `_isCookieAuthenticated(req)`, so we don't really have loose coupling between authentication and CSRF