Replaced session login and CSRF with OAuth2