diff --git a/src/applications/auth/controller/PhabricatorAuthStartController.php b/src/applications/auth/controller/PhabricatorAuthStartController.php
index ab29c5f43f..223acaa757 100644
--- a/src/applications/auth/controller/PhabricatorAuthStartController.php
+++ b/src/applications/auth/controller/PhabricatorAuthStartController.php
@@ -1,200 +1,215 @@
 <?php
 
 final class PhabricatorAuthStartController
   extends PhabricatorAuthController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     if ($viewer->isLoggedIn()) {
       // Kick the user home if they are already logged in.
       return id(new AphrontRedirectResponse())->setURI('/');
     }
 
     if ($request->isAjax()) {
       return $this->processAjaxRequest();
     }
 
     if ($request->isConduit()) {
       return $this->processConduitRequest();
     }
 
-    if (strlen($request->getCookie(PhabricatorCookies::COOKIE_SESSION))) {
-      // The session cookie is invalid, so clear it.
-      $request->clearCookie(PhabricatorCookies::COOKIE_USERNAME);
-      $request->clearCookie(PhabricatorCookies::COOKIE_SESSION);
-
-      return $this->renderError(
-        pht(
-          "Your login session is invalid. Try reloading the page and logging ".
-          "in again. If that does not work, clear your browser cookies."));
+    // If the user gets this far, they aren't logged in, so if they have a
+    // user session token we can conclude that it's invalid: if it was valid,
+    // they'd have been logged in above and never made it here. Try to clear
+    // it and warn the user they may need to nuke their cookies.
+
+    $session_token = $request->getCookie(PhabricatorCookies::COOKIE_SESSION);
+    if (strlen($session_token)) {
+      $kind = PhabricatorAuthSessionEngine::getSessionKindFromToken(
+        $session_token);
+      switch ($kind) {
+        case PhabricatorAuthSessionEngine::KIND_ANONYMOUS:
+          // If this is an anonymous session. It's expected that they won't
+          // be logged in, so we can just continue.
+          break;
+        default:
+          // The session cookie is invalid, so clear it.
+          $request->clearCookie(PhabricatorCookies::COOKIE_USERNAME);
+          $request->clearCookie(PhabricatorCookies::COOKIE_SESSION);
+
+          return $this->renderError(
+            pht(
+              "Your login session is invalid. Try reloading the page and ".
+              "logging in again. If that does not work, clear your browser ".
+              "cookies."));
+      }
     }
 
-
     $providers = PhabricatorAuthProvider::getAllEnabledProviders();
     foreach ($providers as $key => $provider) {
       if (!$provider->shouldAllowLogin()) {
         unset($providers[$key]);
       }
     }
 
     if (!$providers) {
       if ($this->isFirstTimeSetup()) {
         // If this is a fresh install, let the user register their admin
         // account.
         return id(new AphrontRedirectResponse())
           ->setURI($this->getApplicationURI('/register/'));
       }
 
       return $this->renderError(
         pht(
           "This Phabricator install is not configured with any enabled ".
           "authentication providers which can be used to log in. If you ".
           "have accidentally locked yourself out by disabling all providers, ".
           "you can use `phabricator/bin/auth recover <username>` to ".
           "recover access to an administrative account."));
     }
 
     $next_uri = $request->getStr('next');
     if (!$next_uri) {
       $next_uri_path = $this->getRequest()->getPath();
       if ($next_uri_path == '/auth/start/') {
         $next_uri = '/';
       } else {
         $next_uri = $this->getRequest()->getRequestURI();
       }
     }
 
     if (!$request->isFormPost()) {
       $request->setCookie(
         PhabricatorCookies::COOKIE_NEXTURI,
         $next_uri);
       $request->setCookie(
         PhabricatorCookies::COOKIE_CLIENTID,
         Filesystem::readRandomCharacters(16));
     }
 
     $not_buttons = array();
     $are_buttons = array();
     $providers = msort($providers, 'getLoginOrder');
     foreach ($providers as $provider) {
       if ($provider->isLoginFormAButton()) {
         $are_buttons[] = $provider->buildLoginForm($this);
       } else {
         $not_buttons[] = $provider->buildLoginForm($this);
       }
     }
 
     $out = array();
     $out[] = $not_buttons;
     if ($are_buttons) {
       require_celerity_resource('auth-css');
 
       foreach ($are_buttons as $key => $button) {
         $are_buttons[$key] = phutil_tag(
           'div',
           array(
             'class' => 'phabricator-login-button mmb',
           ),
           $button);
       }
 
       // If we only have one button, add a second pretend button so that we
       // always have two columns. This makes it easier to get the alignments
       // looking reasonable.
       if (count($are_buttons) == 1) {
         $are_buttons[] = null;
       }
 
       $button_columns = id(new AphrontMultiColumnView())
         ->setFluidLayout(true);
       $are_buttons = array_chunk($are_buttons, ceil(count($are_buttons) / 2));
       foreach ($are_buttons as $column) {
         $button_columns->addColumn($column);
       }
 
       $out[] = phutil_tag(
         'div',
         array(
           'class' => 'phabricator-login-buttons',
         ),
         $button_columns);
     }
 
     $login_message = PhabricatorEnv::getEnvConfig('auth.login-message');
     $login_message = phutil_safe_html($login_message);
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb(pht('Login'));
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $login_message,
         $out,
       ),
       array(
         'title' => pht('Login to Phabricator'),
         'device' => true,
       ));
   }
 
 
   private function processAjaxRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     // We end up here if the user clicks a workflow link that they need to
     // login to use. We give them a dialog saying "You need to login...".
 
     if ($request->isDialogFormPost()) {
       return id(new AphrontRedirectResponse())->setURI(
         $request->getRequestURI());
     }
 
     $dialog = new AphrontDialogView();
     $dialog->setUser($viewer);
     $dialog->setTitle(pht('Login Required'));
     $dialog->appendChild(pht('You must login to continue.'));
     $dialog->addSubmitButton(pht('Login'));
     $dialog->addCancelButton('/');
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
 
   private function processConduitRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     // A common source of errors in Conduit client configuration is getting
     // the request path wrong. The client will end up here, so make some
     // effort to give them a comprehensible error message.
 
     $request_path = $this->getRequest()->getPath();
     $conduit_path = '/api/<method>';
     $example_path = '/api/conduit.ping';
 
     $message = pht(
       'ERROR: You are making a Conduit API request to "%s", but the correct '.
       'HTTP request path to use in order to access a COnduit method is "%s" '.
       '(for example, "%s"). Check your configuration.',
       $request_path,
       $conduit_path,
       $example_path);
 
     return id(new AphrontPlainTextResponse())->setContent($message);
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Authentication Failure'),
       array($message));
   }
 
 }
diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
index 0db6871ee5..fe40e41536 100644
--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
@@ -1,108 +1,185 @@
 <?php
 
 final class PhabricatorAuthSessionEngine extends Phobject {
 
-  public function loadUserForSession($session_type, $session_key) {
+  /**
+   * Session issued to normal users after they login through a standard channel.
+   * Associates the client with a standard user identity.
+   */
+  const KIND_USER      = 'U';
+
+
+  /**
+   * Session issued to users who login with some sort of credentials but do not
+   * have full accounts. These are sometimes called "grey users".
+   *
+   * TODO: We do not currently issue these sessions, see T4310.
+   */
+  const KIND_EXTERNAL  = 'X';
+
+
+  /**
+   * Session issued to logged-out users which has no real identity information.
+   * Its purpose is to protect logged-out users from CSRF.
+   */
+  const KIND_ANONYMOUS = 'A';
+
+
+  /**
+   * Session kind isn't known.
+   */
+  const KIND_UNKNOWN   = '?';
+
+
+  /**
+   * Get the session kind (e.g., anonymous, user, external account) from a
+   * session token. Returns a `KIND_` constant.
+   *
+   * @param   string  Session token.
+   * @return  const   Session kind constant.
+   */
+  public static function getSessionKindFromToken($session_token) {
+    if (strpos($session_token, '/') === false) {
+      // Old-style session, these are all user sessions.
+      return self::KIND_USER;
+    }
+
+    list($kind, $key) = explode('/', $session_token, 2);
+
+    switch ($kind) {
+      case self::KIND_ANONYMOUS:
+      case self::KIND_USER:
+      case self::KIND_EXTERNAL:
+        return $kind;
+      default:
+        return self::KIND_UNKNOWN;
+    }
+  }
+
+
+  public function loadUserForSession($session_type, $session_token) {
+    $session_kind = self::getSessionKindFromToken($session_token);
+    switch ($session_kind) {
+      case self::KIND_ANONYMOUS:
+        // Don't bother trying to load a user for an anonymous session, since
+        // neither the session nor the user exist.
+        return null;
+      case self::KIND_UNKNOWN:
+        // If we don't know what kind of session this is, don't go looking for
+        // it.
+        return null;
+      case self::KIND_USER:
+        break;
+      case self::KIND_EXTERNAL:
+        // TODO: Implement these (T4310).
+        return null;
+    }
+
     $session_table = new PhabricatorAuthSession();
     $user_table = new PhabricatorUser();
     $conn_r = $session_table->establishConnection('r');
 
     // NOTE: We're being clever here because this happens on every page load,
     // and by joining we can save a query.
 
     $info = queryfx_one(
       $conn_r,
       'SELECT s.sessionExpires AS _sessionExpires, s.id AS _sessionID, u.*
         FROM %T u JOIN %T s ON u.phid = s.userPHID
         AND s.type = %s AND s.sessionKey = %s',
       $user_table->getTableName(),
       $session_table->getTableName(),
       $session_type,
-      PhabricatorHash::digest($session_key));
+      PhabricatorHash::digest($session_token));
 
     if (!$info) {
       return null;
     }
 
     $expires = $info['_sessionExpires'];
     $id = $info['_sessionID'];
     unset($info['_sessionExpires']);
     unset($info['_sessionID']);
 
     $ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // If more than 20% of the time on this session has been used, refresh the
     // TTL back up to the full duration. The idea here is that sessions are
     // good forever if used regularly, but get GC'd when they fall out of use.
 
     if (time() + (0.80 * $ttl) > $expires) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionExpires = UNIX_TIMESTAMP() + %d WHERE id = %d',
           $session_table->getTableName(),
           $ttl,
           $id);
       unset($unguarded);
     }
 
     return $user_table->loadFromArray($info);
   }
 
 
   /**
    * Issue a new session key for a given identity. Phabricator supports
    * different types of sessions (like "web" and "conduit") and each session
    * type may have multiple concurrent sessions (this allows a user to be
    * logged in on multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
-   * @param   const   Session type constant (see
-   *                  @{class:PhabricatorAuthSession}).
-   * @param   phid    Identity to establish a session for, usually a user PHID.
-   * @return  string  Newly generated session key.
+   * @param   const     Session type constant (see
+   *                    @{class:PhabricatorAuthSession}).
+   * @param   phid|null Identity to establish a session for, usually a user
+   *                    PHID. With `null`, generates an anonymous session.
+   * @return  string    Newly generated session key.
    */
   public function establishSession($session_type, $identity_phid) {
-    $session_table = new PhabricatorAuthSession();
-    $conn_w = $session_table->establishConnection('w');
-
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
+    if ($identity_phid === null) {
+      return self::KIND_ANONYMOUS.'/'.$session_key;
+    }
+
+    $session_table = new PhabricatorAuthSession();
+    $conn_w = $session_table->establishConnection('w');
+
     // This has a side effect of validating the session type.
     $session_ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // Logging-in users don't have CSRF stuff yet, so we have to unguard this
     // write.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthSession())
         ->setUserPHID($identity_phid)
         ->setType($session_type)
         ->setSessionKey(PhabricatorHash::digest($session_key))
         ->setSessionStart(time())
         ->setSessionExpires(time() + $session_ttl)
         ->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         null,
         $identity_phid,
         PhabricatorUserLog::ACTION_LOGIN);
       $log->setDetails(
         array(
           'session_type' => $session_type,
         ));
       $log->setSession($session_key);
       $log->save();
     unset($unguarded);
 
     return $session_key;
   }
 
 }
diff --git a/src/applications/auth/storage/PhabricatorAuthSession.php b/src/applications/auth/storage/PhabricatorAuthSession.php
index bb5230dbe2..f9d2e41f6e 100644
--- a/src/applications/auth/storage/PhabricatorAuthSession.php
+++ b/src/applications/auth/storage/PhabricatorAuthSession.php
@@ -1,86 +1,85 @@
 <?php
 
 final class PhabricatorAuthSession extends PhabricatorAuthDAO
   implements PhabricatorPolicyInterface {
 
   const TYPE_WEB      = 'web';
   const TYPE_CONDUIT  = 'conduit';
 
   protected $userPHID;
   protected $type;
   protected $sessionKey;
   protected $sessionStart;
   protected $sessionExpires;
 
   private $identityObject = self::ATTACHABLE;
 
   public function getConfiguration() {
     return array(
       self::CONFIG_TIMESTAMPS => false,
     ) + parent::getConfiguration();
   }
 
   public function getApplicationName() {
     // This table predates the "Auth" application, and really all applications.
     return 'user';
   }
 
   public function getTableName() {
     // This is a very old table with a nonstandard name.
     return PhabricatorUser::SESSION_TABLE;
   }
 
   public function attachIdentityObject($identity_object) {
     $this->identityObject = $identity_object;
     return $this;
   }
 
   public function getIdentityObject() {
     return $this->assertAttached($this->identityObject);
   }
 
   public static function getSessionTypeTTL($session_type) {
     switch ($session_type) {
       case self::TYPE_WEB:
         return (60 * 60 * 24 * 30); // 30 days
       case self::TYPE_CONDUIT:
         return (60 * 60 * 24); // 24 hours
       default:
         throw new Exception(pht('Unknown session type "%s".', $session_type));
     }
   }
 
-
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
     );
   }
 
   public function getPolicy($capability) {
     return PhabricatorPolicies::POLICY_NOONE;
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     if (!$viewer->getPHID()) {
       return false;
     }
 
     $object = $this->getIdentityObject();
     if ($object instanceof PhabricatorUser) {
       return ($object->getPHID() == $viewer->getPHID());
     } else if ($object instanceof PhabricatorExternalAccount) {
       return ($object->getUserPHID() == $viewer->getPHID());
     }
 
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return pht('A session is visible only to its owner.');
   }
 
 }
diff --git a/src/applications/base/controller/PhabricatorController.php b/src/applications/base/controller/PhabricatorController.php
index 6de134f7cd..421a0a30ca 100644
--- a/src/applications/base/controller/PhabricatorController.php
+++ b/src/applications/base/controller/PhabricatorController.php
@@ -1,408 +1,408 @@
 <?php
 
 abstract class PhabricatorController extends AphrontController {
 
   private $handles;
 
   public function shouldRequireLogin() {
     return true;
   }
 
   public function shouldRequireAdmin() {
     return false;
   }
 
   public function shouldRequireEnabledUser() {
     return true;
   }
 
   public function shouldAllowPublic() {
     return false;
   }
 
   public function shouldRequireEmailVerification() {
     return PhabricatorUserEmail::isEmailVerificationRequired();
   }
 
   public function willBeginExecution() {
 
     $request = $this->getRequest();
     if ($request->getUser()) {
       // NOTE: Unit tests can set a user explicitly. Normal requests are not
       // permitted to do this.
       PhabricatorTestCase::assertExecutingUnitTests();
       $user = $request->getUser();
     } else {
       $user = new PhabricatorUser();
 
       $phsid = $request->getCookie(PhabricatorCookies::COOKIE_SESSION);
-      if ($phsid) {
+      if (strlen($phsid)) {
         $session_user = id(new PhabricatorAuthSessionEngine())
           ->loadUserForSession(PhabricatorAuthSession::TYPE_WEB, $phsid);
         if ($session_user) {
           $user = $session_user;
         }
       }
 
       $request->setUser($user);
     }
 
     $translation = $user->getTranslation();
     if ($translation &&
         $translation != PhabricatorEnv::getEnvConfig('translation.provider')) {
       $translation = newv($translation, array());
       PhutilTranslator::getInstance()
         ->setLanguage($translation->getLanguage())
         ->addTranslations($translation->getTranslations());
     }
 
     $preferences = $user->loadPreferences();
     if (PhabricatorEnv::getEnvConfig('darkconsole.enabled')) {
       $dark_console = PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE;
       if ($preferences->getPreference($dark_console) ||
          PhabricatorEnv::getEnvConfig('darkconsole.always-on')) {
         $console = new DarkConsoleCore();
         $request->getApplicationConfiguration()->setConsole($console);
       }
     }
 
     if ($this->shouldRequireEnabledUser()) {
       if ($user->isLoggedIn() && !$user->getIsApproved()) {
         $controller = new PhabricatorAuthNeedsApprovalController($request);
         return $this->delegateToController($controller);
       }
       if ($user->getIsDisabled()) {
         $controller = new PhabricatorDisabledUserController($request);
         return $this->delegateToController($controller);
       }
     }
 
     $event = new PhabricatorEvent(
       PhabricatorEventType::TYPE_CONTROLLER_CHECKREQUEST,
       array(
         'request' => $request,
         'controller' => $this,
       ));
     $event->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
     $checker_controller = $event->getValue('controller');
     if ($checker_controller != $this) {
       return $this->delegateToController($checker_controller);
     }
 
     if ($this->shouldRequireLogin()) {
       // This actually means we need either:
       //   - a valid user, or a public controller; and
       //   - permission to see the application.
 
       $auth_class = 'PhabricatorApplicationAuth';
       $auth_application = PhabricatorApplication::getByClass($auth_class);
 
       $allow_public = $this->shouldAllowPublic() &&
                       PhabricatorEnv::getEnvConfig('policy.allow-public');
 
       // If this controller isn't public, and the user isn't logged in, require
       // login.
       if (!$allow_public && !$user->isLoggedIn()) {
         $login_controller = new PhabricatorAuthStartController($request);
         $this->setCurrentApplication($auth_application);
         return $this->delegateToController($login_controller);
       }
 
       if ($user->isLoggedIn()) {
         if ($this->shouldRequireEmailVerification()) {
           if (!$user->getIsEmailVerified()) {
             $controller = new PhabricatorMustVerifyEmailController($request);
             $this->setCurrentApplication($auth_application);
             return $this->delegateToController($controller);
           }
         }
       }
 
       // If the user doesn't have access to the application, don't let them use
       // any of its controllers. We query the application in order to generate
       // a policy exception if the viewer doesn't have permission.
 
       $application = $this->getCurrentApplication();
       if ($application) {
         id(new PhabricatorApplicationQuery())
           ->setViewer($user)
           ->withPHIDs(array($application->getPHID()))
           ->executeOne();
       }
     }
 
     // NOTE: We do this last so that users get a login page instead of a 403
     // if they need to login.
     if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
       return new Aphront403Response();
     }
 
   }
 
   public function buildStandardPageView() {
     $view = new PhabricatorStandardPageView();
     $view->setRequest($this->getRequest());
     $view->setController($this);
     return $view;
   }
 
   public function buildStandardPageResponse($view, array $data) {
     $page = $this->buildStandardPageView();
     $page->appendChild($view);
     $response = new AphrontWebpageResponse();
     $response->setContent($page->render());
     return $response;
   }
 
   public function getApplicationURI($path = '') {
     if (!$this->getCurrentApplication()) {
       throw new Exception("No application!");
     }
     return $this->getCurrentApplication()->getApplicationURI($path);
   }
 
   public function buildApplicationPage($view, array $options) {
     $page = $this->buildStandardPageView();
 
     $title = PhabricatorEnv::getEnvConfig('phabricator.serious-business') ?
       'Phabricator' :
       pht('Bacon Ice Cream for Breakfast');
 
     $application = $this->getCurrentApplication();
     $page->setTitle(idx($options, 'title', $title));
     if ($application) {
       $page->setApplicationName($application->getName());
       if ($application->getTitleGlyph()) {
         $page->setGlyph($application->getTitleGlyph());
       }
     }
 
     if (!($view instanceof AphrontSideNavFilterView)) {
       $nav = new AphrontSideNavFilterView();
       $nav->appendChild($view);
       $view = $nav;
     }
 
     $user = $this->getRequest()->getUser();
     $view->setUser($user);
 
     $page->appendChild($view);
 
     $object_phids = idx($options, 'pageObjects', array());
     if ($object_phids) {
       $page->appendPageObjects($object_phids);
       foreach ($object_phids as $object_phid) {
         PhabricatorFeedStoryNotification::updateObjectNotificationViews(
           $user,
           $object_phid);
       }
     }
 
     if (idx($options, 'device')) {
       $page->setDeviceReady(true);
     }
 
     $page->setShowChrome(idx($options, 'chrome', true));
 
     $application_menu = $this->buildApplicationMenu();
     if ($application_menu) {
       $page->setApplicationMenu($application_menu);
     }
 
     $response = new AphrontWebpageResponse();
     return $response->setContent($page->render());
   }
 
   public function didProcessRequest($response) {
     $request = $this->getRequest();
     $response->setRequest($request);
 
     $seen = array();
     while ($response instanceof AphrontProxyResponse) {
 
       $hash = spl_object_hash($response);
       if (isset($seen[$hash])) {
         $seen[] = get_class($response);
         throw new Exception(
           "Cycle while reducing proxy responses: ".
           implode(' -> ', $seen));
       }
       $seen[$hash] = get_class($response);
 
       $response = $response->reduceProxyResponse();
     }
 
     if ($response instanceof AphrontDialogResponse) {
       if (!$request->isAjax()) {
         $view = new PhabricatorStandardPageView();
         $view->setRequest($request);
         $view->setController($this);
         $view->appendChild(phutil_tag(
           'div',
           array('style' => 'padding: 2em 0;'),
           $response->buildResponseString()));
         $page_response = new AphrontWebpageResponse();
         $page_response->setContent($view->render());
         $page_response->setHTTPResponseCode($response->getHTTPResponseCode());
         return $page_response;
       } else {
         $response->getDialog()->setIsStandalone(true);
 
         return id(new AphrontAjaxResponse())
           ->setContent(array(
             'dialog' => $response->buildResponseString(),
           ));
       }
     } else if ($response instanceof AphrontRedirectResponse) {
       if ($request->isAjax()) {
         return id(new AphrontAjaxResponse())
           ->setContent(
             array(
               'redirect' => $response->getURI(),
             ));
       }
     }
     return $response;
   }
 
   protected function getHandle($phid) {
     if (empty($this->handles[$phid])) {
       throw new Exception(
         "Attempting to access handle which wasn't loaded: {$phid}");
     }
     return $this->handles[$phid];
   }
 
   protected function loadHandles(array $phids) {
     $phids = array_filter($phids);
     $this->handles = $this->loadViewerHandles($phids);
     return $this;
   }
 
   protected function getLoadedHandles() {
     return $this->handles;
   }
 
   protected function loadViewerHandles(array $phids) {
     return id(new PhabricatorHandleQuery())
       ->setViewer($this->getRequest()->getUser())
       ->withPHIDs($phids)
       ->execute();
   }
 
 
   /**
    * Render a list of links to handles, identified by PHIDs. The handles must
    * already be loaded.
    *
    * @param   list<phid>  List of PHIDs to render links to.
    * @param   string      Style, one of "\n" (to put each item on its own line)
    *                      or "," (to list items inline, separated by commas).
    * @return  string      Rendered list of handle links.
    */
   protected function renderHandlesForPHIDs(array $phids, $style = "\n") {
     $style_map = array(
       "\n"  => phutil_tag('br'),
       ','   => ', ',
     );
 
     if (empty($style_map[$style])) {
       throw new Exception("Unknown handle list style '{$style}'!");
     }
 
     return implode_selected_handle_links($style_map[$style],
       $this->getLoadedHandles(),
       array_filter($phids));
   }
 
   protected function buildApplicationMenu() {
     return null;
   }
 
   protected function buildApplicationCrumbs() {
 
     $crumbs = array();
 
     $application = $this->getCurrentApplication();
     if ($application) {
       $sprite = $application->getIconName();
       if (!$sprite) {
         $sprite = 'application';
       }
 
       $crumbs[] = id(new PhabricatorCrumbView())
         ->setHref($this->getApplicationURI())
         ->setIcon($sprite);
     }
 
     $view = new PhabricatorCrumbsView();
     foreach ($crumbs as $crumb) {
       $view->addCrumb($crumb);
     }
 
     return $view;
   }
 
   protected function hasApplicationCapability($capability) {
     return PhabricatorPolicyFilter::hasCapability(
       $this->getRequest()->getUser(),
       $this->getCurrentApplication(),
       $capability);
   }
 
   protected function requireApplicationCapability($capability) {
     PhabricatorPolicyFilter::requireCapability(
       $this->getRequest()->getUser(),
       $this->getCurrentApplication(),
       $capability);
   }
 
   protected function explainApplicationCapability(
     $capability,
     $positive_message,
     $negative_message) {
 
     $can_act = $this->hasApplicationCapability($capability);
     if ($can_act) {
       $message = $positive_message;
       $icon_name = 'enable-grey';
     } else {
       $message = $negative_message;
       $icon_name = 'lock';
     }
 
     $icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_ICONS)
       ->setSpriteIcon($icon_name);
 
     require_celerity_resource('policy-css');
 
     $phid = $this->getCurrentApplication()->getPHID();
     $explain_uri = "/policy/explain/{$phid}/{$capability}/";
 
     $message = phutil_tag(
       'div',
       array(
         'class' => 'policy-capability-explanation',
       ),
       array(
         $icon,
         javelin_tag(
           'a',
           array(
             'href' => $explain_uri,
             'sigil' => 'workflow',
           ),
           $message),
       ));
 
     return array($can_act, $message);
   }
 
   public function getDefaultResourceSource() {
     return 'phabricator';
   }
 
 
 }
diff --git a/src/applications/people/storage/PhabricatorUserLog.php b/src/applications/people/storage/PhabricatorUserLog.php
index 61d3ecab46..b82799ae6f 100644
--- a/src/applications/people/storage/PhabricatorUserLog.php
+++ b/src/applications/people/storage/PhabricatorUserLog.php
@@ -1,99 +1,100 @@
 <?php
 
 final class PhabricatorUserLog extends PhabricatorUserDAO {
 
   const ACTION_LOGIN          = 'login';
   const ACTION_LOGOUT         = 'logout';
   const ACTION_LOGIN_FAILURE  = 'login-fail';
   const ACTION_RESET_PASSWORD = 'reset-pass';
 
   const ACTION_CREATE         = 'create';
   const ACTION_EDIT           = 'edit';
 
   const ACTION_ADMIN          = 'admin';
   const ACTION_SYSTEM_AGENT   = 'system-agent';
   const ACTION_DISABLE        = 'disable';
   const ACTION_APPROVE        = 'approve';
   const ACTION_DELETE         = 'delete';
 
   const ACTION_CONDUIT_CERTIFICATE = 'conduit-cert';
   const ACTION_CONDUIT_CERTIFICATE_FAILURE = 'conduit-cert-fail';
 
   const ACTION_EMAIL_PRIMARY    = 'email-primary';
   const ACTION_EMAIL_REMOVE     = 'email-remove';
   const ACTION_EMAIL_ADD        = 'email-add';
 
   const ACTION_CHANGE_PASSWORD  = 'change-password';
   const ACTION_CHANGE_USERNAME  = 'change-username';
 
   protected $actorPHID;
   protected $userPHID;
   protected $action;
   protected $oldValue;
   protected $newValue;
   protected $details = array();
   protected $remoteAddr;
   protected $session;
 
   public static function initializeNewLog(
     PhabricatorUser $actor = null,
     $object_phid,
     $action) {
 
     $log = new PhabricatorUserLog();
 
     if ($actor) {
       $log->setActorPHID($actor->getPHID());
     }
 
     $log->setUserPHID((string)$object_phid);
     $log->setAction($action);
 
     return $log;
   }
 
   public static function loadRecentEventsFromThisIP($action, $timespan) {
     return id(new PhabricatorUserLog())->loadAllWhere(
       'action = %s AND remoteAddr = %s AND dateCreated > %d
         ORDER BY dateCreated DESC',
       $action,
       idx($_SERVER, 'REMOTE_ADDR'),
       time() - $timespan);
   }
 
   public function save() {
     if (!$this->remoteAddr) {
       $this->remoteAddr = idx($_SERVER, 'REMOTE_ADDR', '');
     }
     if (!$this->session) {
       // TODO: This is not correct if there's a cookie prefix. This object
       // should take an AphrontRequest.
+      // TODO: Maybe record session kind, or drop this for anonymous sessions?
       $this->setSession(idx($_COOKIE, PhabricatorCookies::COOKIE_SESSION));
     }
     $this->details['host'] = php_uname('n');
     $this->details['user_agent'] = AphrontRequest::getHTTPHeader('User-Agent');
 
     return parent::save();
   }
 
   public function setSession($session) {
     // Store the hash of the session, not the actual session key, so that
     // seeing the logs doesn't compromise all the sessions which appear in
     // them. This just prevents casual leaks, like in a screenshot.
     if (strlen($session)) {
       $this->session = PhabricatorHash::digest($session);
     }
     return $this;
   }
 
   public function getConfiguration() {
     return array(
       self::CONFIG_SERIALIZATION => array(
         'oldValue' => self::SERIALIZATION_JSON,
         'newValue' => self::SERIALIZATION_JSON,
         'details'  => self::SERIALIZATION_JSON,
       ),
     ) + parent::getConfiguration();
   }
 
 }
diff --git a/src/view/page/PhabricatorStandardPageView.php b/src/view/page/PhabricatorStandardPageView.php
index d31c3567b8..d3eeccb28c 100644
--- a/src/view/page/PhabricatorStandardPageView.php
+++ b/src/view/page/PhabricatorStandardPageView.php
@@ -1,438 +1,449 @@
 <?php
 
 /**
  * This is a standard Phabricator page with menus, Javelin, DarkConsole, and
  * basic styles.
  *
  */
 final class PhabricatorStandardPageView extends PhabricatorBarePageView {
 
   private $baseURI;
   private $applicationName;
   private $glyph;
   private $menuContent;
   private $showChrome = true;
   private $disableConsole;
   private $searchDefaultScope;
   private $pageObjects = array();
   private $applicationMenu;
 
   public function setApplicationMenu(PHUIListView $application_menu) {
     $this->applicationMenu = $application_menu;
     return $this;
   }
 
   public function getApplicationMenu() {
     return $this->applicationMenu;
   }
 
   public function setApplicationName($application_name) {
     $this->applicationName = $application_name;
     return $this;
   }
 
   public function setDisableConsole($disable) {
     $this->disableConsole = $disable;
     return $this;
   }
 
   public function getApplicationName() {
     return $this->applicationName;
   }
 
   public function setBaseURI($base_uri) {
     $this->baseURI = $base_uri;
     return $this;
   }
 
   public function getBaseURI() {
     return $this->baseURI;
   }
 
   public function setShowChrome($show_chrome) {
     $this->showChrome = $show_chrome;
     return $this;
   }
 
   public function getShowChrome() {
     return $this->showChrome;
   }
 
   public function setSearchDefaultScope($search_default_scope) {
     $this->searchDefaultScope = $search_default_scope;
     return $this;
   }
 
   public function getSearchDefaultScope() {
     return $this->searchDefaultScope;
   }
 
   public function appendPageObjects(array $objs) {
     foreach ($objs as $obj) {
       $this->pageObjects[] = $obj;
     }
   }
 
   public function getTitle() {
     $use_glyph = true;
 
     $request = $this->getRequest();
     if ($request) {
       $user = $request->getUser();
       if ($user && $user->loadPreferences()->getPreference(
             PhabricatorUserPreferences::PREFERENCE_TITLES) !== 'glyph') {
         $use_glyph = false;
       }
     }
 
     $title = parent::getTitle();
 
     $prefix = null;
     if ($use_glyph) {
       $prefix = $this->getGlyph();
     } else {
       $application_name = $this->getApplicationName();
       if (strlen($application_name)) {
         $prefix = '['.$application_name.']';
       }
     }
 
     if (strlen($prefix)) {
       $title = $prefix.' '.$title;
     }
 
     return $title;
   }
 
 
   protected function willRenderPage() {
     parent::willRenderPage();
 
     if (!$this->getRequest()) {
       throw new Exception(
         pht(
           "You must set the Request to render a PhabricatorStandardPageView."));
     }
 
     $console = $this->getConsole();
 
     require_celerity_resource('phabricator-core-css');
     require_celerity_resource('phabricator-zindex-css');
     require_celerity_resource('phui-button-css');
     require_celerity_resource('phui-spacing-css');
     require_celerity_resource('phui-form-css');
     require_celerity_resource('sprite-gradient-css');
     require_celerity_resource('phabricator-standard-page-view');
 
     Javelin::initBehavior('workflow', array());
 
     $request = $this->getRequest();
     $user = null;
     if ($request) {
       $user = $request->getUser();
     }
 
     if ($user) {
       $default_img_uri =
         PhabricatorEnv::getCDNURI(
           '/rsrc/image/icon/fatcow/document_black.png');
       $download_form = phabricator_form(
         $user,
         array(
           'action' => '#',
           'method' => 'POST',
           'class'  => 'lightbox-download-form',
           'sigil'  => 'download',
         ),
         phutil_tag(
           'button',
           array(),
           pht('Download')));
 
       Javelin::initBehavior(
         'lightbox-attachments',
         array(
           'defaultImageUri' => $default_img_uri,
           'downloadForm'    => $download_form,
         ));
     }
 
     Javelin::initBehavior('aphront-form-disable-on-submit');
     Javelin::initBehavior('toggle-class', array());
     Javelin::initBehavior('konami', array());
     Javelin::initBehavior('history-install');
     Javelin::initBehavior('phabricator-gesture');
 
+    // If the client doesn't have a session token, generate an anonymous
+    // session. This is used to provide CSRF protection to logged-out users.
+    $session_token = $request->getCookie(PhabricatorCookies::COOKIE_SESSION);
+    if (!strlen($session_token)) {
+      $anonymous_session = id(new PhabricatorAuthSessionEngine())
+        ->establishSession('web', null);
+      $request->setCookie(
+        PhabricatorCookies::COOKIE_SESSION,
+        $anonymous_session);
+    }
+
     $current_token = null;
     if ($user) {
       $current_token = $user->getCSRFToken();
     }
 
     Javelin::initBehavior(
       'refresh-csrf',
       array(
         'tokenName' => AphrontRequest::getCSRFTokenName(),
         'header'    => AphrontRequest::getCSRFHeaderName(),
         'current'   => $current_token,
       ));
 
     Javelin::initBehavior('device');
 
     if ($console) {
       require_celerity_resource('aphront-dark-console-css');
 
       $headers = array();
       if (DarkConsoleXHProfPluginAPI::isProfilerStarted()) {
         $headers[DarkConsoleXHProfPluginAPI::getProfilerHeader()] = 'page';
       }
       if (DarkConsoleServicesPlugin::isQueryAnalyzerRequested()) {
         $headers[DarkConsoleServicesPlugin::getQueryAnalyzerHeader()] = true;
       }
 
       Javelin::initBehavior(
         'dark-console',
         array(
           // NOTE: We use a generic label here to prevent input reflection
           // and mitigate compression attacks like BREACH. See discussion in
           // T3684.
           'uri' => pht('Main Request'),
           'selected' => $user ? $user->getConsoleTab() : null,
           'visible'  => $user ? (int)$user->getConsoleVisible() : true,
           'headers' => $headers,
         ));
 
       // Change this to initBehavior when there is some behavior to initialize
       require_celerity_resource('javelin-behavior-error-log');
     }
 
     if ($user) {
       $viewer = $user;
     } else {
       $viewer = new PhabricatorUser();
     }
 
     $menu = id(new PhabricatorMainMenuView())
       ->setUser($viewer)
       ->setDefaultSearchScope($this->getSearchDefaultScope());
 
     if ($this->getController()) {
       $menu->setController($this->getController());
     }
 
     if ($this->getApplicationMenu()) {
       $menu->setApplicationMenu($this->getApplicationMenu());
     }
 
     $this->menuContent = $menu->render();
   }
 
 
   protected function getHead() {
     $monospaced = PhabricatorEnv::getEnvConfig('style.monospace');
     $monospaced_win = PhabricatorEnv::getEnvConfig('style.monospace.windows');
 
     $request = $this->getRequest();
     if ($request) {
       $user = $request->getUser();
       if ($user) {
         $pref = $user->loadPreferences()->getPreference(
             PhabricatorUserPreferences::PREFERENCE_MONOSPACED);
         $monospaced = nonempty($pref, $monospaced);
         $monospaced_win = nonempty($pref, $monospaced_win);
       }
     }
 
     $response = CelerityAPI::getStaticResourceResponse();
 
     return hsprintf(
       '%s<style type="text/css">'.
       '.PhabricatorMonospaced, '.
       '.phabricator-remarkup .remarkup-code-block { font: %s; } '.
       '.platform-windows .PhabricatorMonospaced, '.
       '.platform-windows .phabricator-remarkup '.
         '.remarkup-code-block { font: %s; }'.
       '</style>%s',
       parent::getHead(),
       phutil_safe_html($monospaced),
       phutil_safe_html($monospaced_win),
       $response->renderSingleResource('javelin-magical-init', 'phabricator'));
   }
 
   public function setGlyph($glyph) {
     $this->glyph = $glyph;
     return $this;
   }
 
   public function getGlyph() {
     return $this->glyph;
   }
 
   protected function willSendResponse($response) {
     $request = $this->getRequest();
     $response = parent::willSendResponse($response);
 
     $console = $request->getApplicationConfiguration()->getConsole();
 
     if ($console) {
       $response = PhutilSafeHTML::applyFunction(
         'str_replace',
         hsprintf('<darkconsole />'),
         $console->render($request),
         $response);
     }
 
     return $response;
   }
 
   protected function getBody() {
     $console = $this->getConsole();
 
     $user = null;
     $request = $this->getRequest();
     if ($request) {
       $user = $request->getUser();
     }
 
     $header_chrome = null;
     if ($this->getShowChrome()) {
       $header_chrome = $this->menuContent;
     }
 
     $developer_warning = null;
     if (PhabricatorEnv::getEnvConfig('phabricator.developer-mode') &&
         DarkConsoleErrorLogPluginAPI::getErrors()) {
       $developer_warning = phutil_tag_div(
         'aphront-developer-error-callout',
         pht(
           'This page raised PHP errors. Find them in DarkConsole '.
           'or the error log.'));
     }
 
     // Render the "you have unresolved setup issues..." warning.
     $setup_warning = null;
     if ($user && $user->getIsAdmin()) {
       $open = PhabricatorSetupCheck::getOpenSetupIssueCount();
       if ($open) {
         $setup_warning = phutil_tag_div(
           'setup-warning-callout',
           phutil_tag(
             'a',
             array(
               'href' => '/config/issue/',
             ),
             pht('You have %d unresolved setup issue(s)...', $open)));
       }
     }
 
     return
       phutil_tag(
         'div',
         array(
           'id' => 'base-page',
           'class' => 'phabricator-standard-page',
         ),
         array(
           $developer_warning,
           $setup_warning,
           $header_chrome,
           phutil_tag_div('phabricator-standard-page-body', array(
             ($console ? hsprintf('<darkconsole />') : null),
             parent::getBody(),
             phutil_tag('div', array('style' => 'clear: both;')),
           )),
         ));
   }
 
   protected function getTail() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $container = null;
     if ($user && $user->isLoggedIn()) {
 
       $aphlict_object_id = celerity_generate_unique_node_id();
       $aphlict_container_id = celerity_generate_unique_node_id();
 
       $client_uri = PhabricatorEnv::getEnvConfig('notification.client-uri');
       $client_uri = new PhutilURI($client_uri);
       if ($client_uri->getDomain() == 'localhost') {
         $this_host = $this->getRequest()->getHost();
         $this_host = new PhutilURI('http://'.$this_host.'/');
         $client_uri->setDomain($this_host->getDomain());
       }
 
       $enable_debug = PhabricatorEnv::getEnvConfig('notification.debug');
       Javelin::initBehavior(
         'aphlict-listen',
         array(
           'id'           => $aphlict_object_id,
           'containerID'  => $aphlict_container_id,
           'server'       => $client_uri->getDomain(),
           'port'         => $client_uri->getPort(),
           'debug'        => $enable_debug,
           'pageObjects'  => array_fill_keys($this->pageObjects, true),
         ));
       $container = phutil_tag(
         'div',
         array(
           'id' => $aphlict_container_id,
           'style' =>
             'position: absolute; width: 0; height: 0; overflow: hidden;',
         ),
         '');
     }
 
     $response = CelerityAPI::getStaticResourceResponse();
 
     $tail = array(
       parent::getTail(),
       $container,
       $response->renderHTMLFooter(),
     );
 
     return phutil_implode_html("\n", $tail);
   }
 
   protected function getBodyClasses() {
     $classes = array();
 
     if (!$this->getShowChrome()) {
       $classes[] = 'phabricator-chromeless-page';
     }
 
     $agent = AphrontRequest::getHTTPHeader('User-Agent');
 
     // Try to guess the device resolution based on UA strings to avoid a flash
     // of incorrectly-styled content.
     $device_guess = 'device-desktop';
     if (preg_match('@iPhone|iPod|(Android.*Chrome/[.0-9]* Mobile)@', $agent)) {
       $device_guess = 'device-phone device';
     } else if (preg_match('@iPad|(Android.*Chrome/)@', $agent)) {
       $device_guess = 'device-tablet device';
     }
 
     $classes[] = $device_guess;
 
     if (preg_match('@Windows@', $agent)) {
       $classes[] = 'platform-windows';
     } else if (preg_match('@Macintosh@', $agent)) {
       $classes[] = 'platform-mac';
     } else if (preg_match('@X11@', $agent)) {
       $classes[] = 'platform-linux';
     }
 
     if ($this->getRequest()->getStr('__print__')) {
       $classes[] = 'printable';
     }
 
     return implode(' ', $classes);
   }
 
   private function getConsole() {
     if ($this->disableConsole) {
       return null;
     }
     return $this->getRequest()->getApplicationConfiguration()->getConsole();
   }
 
 }