🔒 CSRF-safe · works without JavaScript Logins are generated server-side