TODO: session, access_token, X-CSRF-Token