User states v1
Flushing session vars on logout
Token-based authentication
Client-side token-based login