CSRF protection on signin/signout.
Different Ajax for preference submission.