More corrections around authentication, passing back new csrf token.