anchor.diff:  % {ok, PostVals, Req2} = cowboy_req:body_qs(Req),
   % Echo = proplists:get_value(<<"echo">>, PostVals),
   % cowboy_req:reply(400, [], <<"Missing body.">>, Req)
  -reply_200_json(Body, SessionToken, Req) when is_binary(SessionToken) ->
  +reply_200_json(Body, SessionToken, Req) ->
       CookieName = cookie_name(?SESSION_COOKIE),
       Req2 = case cowboy_req:cookie(CookieName, Req, <<>>) of
           {SessionToken, Req1} -> Req1;
           {_, Req1} ->
               {Host, Req} = cowboy_req:host(Req),
               Path = dderl:format_path(dderl:get_url_suffix()),
  -            cowboy_req:set_resp_cookie(CookieName, SessionToken,
  -                                        ?HTTP_ONLY_COOKIE_OPTS(Host, Path), Req1)
  +            {SessToken, Opts} = get_cookie_opts(SessionToken, ?HTTP_ONLY_COOKIE_OPTS(Host, Path)),
  +            cowboy_req:set_resp_cookie(CookieName, SessToken, Opts, Req1)
       end,
       cowboy_req:reply(200, [
             {<<"content-encoding">>, <<"utf-8">>}
  
positive.code:     XSRFCookie = cookie_name(?XSRF_COOKIE),
      {Host, Req} = cowboy_req:host(Req),
      Path = dderl:format_path(dderl:get_url_suffix()),
      cowboy_req:set_resp_cookie(XSRFCookie, XSRFToken, ?COOKIE_OPTS(Host, Path), Req).
  
  cookie_name(Name) ->
      HostApp = dderl_dal:get_host_app(),
      list_to_binary([HostApp, Name]).
  
  %-define(DISP_REQ, true).
  -ifdef(DISP_REQ).
  
negative.code:     ?Debug("spawn fun~n to ~p", [State#state.sessionToken]),
      spawn(SpawnFun),
      {loop, Req, State, hibernate};
  info({reply, [{<<"logout">>, _} | _] = Body}, Req, State) ->
      %% delete session cookie
      Req1 = set_xsrf_cookie(Req, none, delete_cookie),
      info({reply, imem_json:encode(Body)}, Req1, State#state{sessionToken = delete_cookie});
  info({reply, Body}, Req, #state{sessionToken = SessionToken} = State) ->
      ?Debug("reply ~n~p to ~p", [Body, SessionToken]),
      BodyEnc = if is_binary(Body) -> Body;
  