I'm a student learning Laravel trying to build auth from scratch without Breeze. I understand the basic flow but I'm confused about session handling and CSRF tokens. Any advice from experienced devs?