anchor.diff:      ?Debug("spawn fun~n to ~p", [State#state.sessionToken]),
       spawn(SpawnFun),
       {loop, Req, State, hibernate};
  +info({reply, [{<<"logout">>, _} | _] = Body}, Req, State) ->
  +    %% delete session cookie
  +    Req1 = set_xsrf_cookie(Req, none, delete_cookie),
  +    info({reply, imem_json:encode(Body)}, Req1, State#state{sessionToken = delete_cookie});
   info({reply, Body}, Req, #state{sessionToken = SessionToken} = State) ->
       ?Debug("reply ~n~p to ~p", [Body, SessionToken]),
       BodyEnc = if is_binary(Body) -> Body;
  
positive.code:                     {loop, set_xsrf_cookie(Req, XSRFToken, NewXSRFToken),
                       #state{sessionToken = NewToken}, 3600000, hibernate};
                  [<<"logout">>] ->
                      self() ! {reply, imem_json:encode([{<<"logout">>, <<"ok">>}])},
                      {loop, Req, #state{sessionToken = SessionToken},
                       5000, hibernate};
                  _ ->
  
negative.code:     XSRFCookie = cookie_name(?XSRF_COOKIE),
      {Host, Req} = cowboy_req:host(Req),
      Path = dderl:format_path(dderl:get_url_suffix()),
      {XSRFToken1, Opts} = get_cookie_opts(XSRFToken, ?COOKIE_OPTS(Host, Path)),
      cowboy_req:set_resp_cookie(XSRFCookie, XSRFToken1, Opts, Req).
  
  cookie_name(Name) ->
      HostApp = dderl_dal:get_host_app(),
      list_to_binary([HostApp, Name]).
  
  get_cookie_opts(delete_cookie, Opts) -> {<<>>, [{max_age, 0} | Opts]};
  get_cookie_opts(Cookie, Opts) -> {Cookie, Opts}.
  
  %-define(DISP_REQ, true).
  -ifdef(DISP_REQ).
  