Updated info on _ param
Authentication is done via Cookies/sessions
More notes