1. No session integration yet, so automatic login/logout events are suppressed. 2. Popup blockers must be disabled: submits form to target="_blank"