- Add comment to SecurityConfig explaining why CSRF is disabled - Add SecurityContextHolder.clearContext() to logout for clean thread state - Add Javadoc on authenticateInSession() explaining manual session setup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>