anchor.diff:      ?Debug("spawn fun~n to ~p", [State#state.sessionToken]),
       spawn(SpawnFun),
       {loop, Req, State, hibernate};
  +info({reply, [{<<"logout">>, _} | _] = Body}, Req, State) ->
  +    %% delete session cookie
  +    Req1 = set_xsrf_cookie(Req, none, delete_cookie),
  +    info({reply, imem_json:encode(Body)}, Req1, State#state{sessionToken = delete_cookie});
   info({reply, Body}, Req, #state{sessionToken = SessionToken} = State) ->
       ?Debug("reply ~n~p to ~p", [Body, SessionToken]),
       BodyEnc = if is_binary(Body) -> Body;
  
positive.code: % {ok, PostVals, Req2} = cowboy_req:body_qs(Req),
  % Echo = proplists:get_value(<<"echo">>, PostVals),
  % cowboy_req:reply(400, [], <<"Missing body.">>, Req)
  reply_200_json(Body, SessionToken, Req) when is_binary(SessionToken) ->
      CookieName = cookie_name(?SESSION_COOKIE),
      Req2 = case cowboy_req:cookie(CookieName, Req, <<>>) of
          {SessionToken, Req1} -> Req1;
          {_, Req1} ->
              {Host, Req} = cowboy_req:host(Req),
              Path = dderl:format_path(dderl:get_url_suffix()),
              cowboy_req:set_resp_cookie(CookieName, SessionToken,
                                          ?HTTP_ONLY_COOKIE_OPTS(Host, Path), Req1)
      end,
      cowboy_req:reply(200, [
            {<<"content-encoding">>, <<"utf-8">>}
  
negative.code:                     {loop, set_xsrf_cookie(Req, XSRFToken, NewXSRFToken),
                       #state{sessionToken = NewToken}, 3600000, hibernate};
                  [<<"logout">>] ->
                      self() ! {reply, [{<<"logout">>, <<"ok">>}]},
                      {loop, Req, #state{sessionToken = SessionToken},
                       5000, hibernate};
                  _ ->
  