I see that you are importing gorp from github.com/go-gorp/gorp.
This is the unstable "bleeding edge" version. We are working on breaking changes, it is likely that your program will fail to compile unless you update your code to reflect the changes.

Please use gopkg.in/gorp.v1 as import path, it provides the last stable gorp v1 release and will not break (unless a breaking change is required to fix a security issue).

When the changes to the master branch are complete, v2 will be released. See go-gorp/gorp#270 for more information.
Thanks.

1. In server.go, I created this routes

goji.Get("/apitest", application.Route(controller, "apitest"))
goji.Get("/api/test", application.Route(controller, "apitest"))

Both of them just prints out the value of session.Values["UserId"]

1. I log in, so that session.Values["UserId"] has a value.
2. I visit both /apitest and /api/test, and they print out value of session.Values["UserId"] fine
3. Then I log out, so that session.Values["UserId"] is set to nil
4. I visit both /apitest and /api/test, /apitest will now print out nil; api/test still print the value of session.Values["UserId"]

What did I do wrong here?

Hi,

I must be missing something, but just wondering how are you clearing the gorilla session in these sample project? As per their doc http://www.gorillatoolkit.org/pkg/sessions

Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory! An easy way to do this is to wrap the top-level mux when calling http.ListenAndServe: "

So aren't we supposed to clear them somehow?
Thanks

When siging up and later signing in all I get is "Invalid Csrf Token". I'm probably overlooking something but the subtle.ConstantTimeCompare(x, y) in "isValidToken" never throws a 1 for me.
Like I said, I'm probably overlooking something. Thanks.

Since you are using Gorilla Session, wouldn't you need the following middleware at the end of the middleware use chain in server.go

goji.Use(context.ClearHandler)

This uses the ClearHandler from gorilla.context to not leak memory.

See http://www.gorillatoolkit.org/pkg/sessions (search for phrase "Important Note")
I could of course be missing something. Thanks for an excellent example for how to use Goji. I've been learning immensely from using it. Thanks.