on postback, ValidateAnitiforgeryToken validation compare a value in the cookie to form field value. In mvc every response updates the cookie value, and if the response contains a form, the value is rendered in a hidden field.
authentication of a request is just checking a token in the cookie value. the token contains the user name and claims. a successful login post should return the cookie value. the value, unlike a jwt token, is a custom format and encryption.