The cached page contains content suitable for everyone, so it looks the the user is logged out. An extra AJAX request grabs the users logged in status, CSRF to

The cached page contains content suitable for everyone, so it looks the the user is logged out. An extra AJAX request grabs the users logged in status, CSRF token and similar data as JSON and then modifies the page so the user sees what they expect (a logout button, a comment form, etc).