{auth} renders its content once when a user is logged in to this application - by padLogin ( $row ) or padAttempt ( ... ) - with the user's row as its data: every field of it is a {$field} inside, {$name}, {$email}. The password and token fields were never kept, so they are not there.

For a guest the part after its own {else} renders, or the @else@ half. The tag owns that {else}: an {if} around it keeps its own. {guest} is the reverse and hands over no data.

Reading the user never starts a session the visitor did not bring - a guest's page makes no session - but a request that brings the remember-me cookie is logged in here, the first time anything asks. padUser ( 'name' ), padUserId () and padAuthCheck () ask the same from PHP.

The examples run without a login, so the runnable one shows the guest's half; the other is shown, not run.