Create a cookie to clear csrf cookie.

Make a CSRF cookie (used during login only).

Create an auth cookie.

Create a name cookie.

Cookie = hash(secret, cookie domain, email, expires)|expires|email|groups.

Validate the csrf cookie against state.

Validate email.

Cookie Domain.