Make it yours.

1. Two sessions, one user. Log in from your normal browser and from a private window — SELECT count(*) FROM sessions is now 2 (two devices, two tokens, same user). Log out of one; the other still works. Server-side sessions are per-device, and you can revoke them one at a time — something to appreciate before lesson 14's JWT comparison.

2. Watch LoadUser annotate anonymously. Log out, then hit the public home page. It renders fine (no login required) — LoadUser ran, found no valid cookie, and passed the request through as anonymous. Now log in and hit / again: Home's new branch redirects you to /dashboard. Same handler, two behaviours, driven by context.

3. Protect a route of your own. Add a GET /account inside the RequireAuth group with a handler that renders a simple templ page showing the user's email (UserFrom(r.Context())). Confirm it redirects to /login when logged out and renders when logged in.

Where this is going — the gotcha lesson. Your login, register, and logout forms all POST happily right now. They shouldn't. Any other website could POST to your /logout (or worse) on your users' behalf — that's CSRF. Lesson 6 adds gorilla/csrf… and the moment you do, submitting one of these very forms over http://localhost fails with a 403 Forbidden — referer not supplied: an error that explains nothing. You'll hit it first, then learn exactly what CSRF protection checks and why that message appears. Debugging it is the lesson.