Authorized access only. Sessions are httpOnly and rate-limited.
Protected with CSRF, lockout after failed attempts, and secure cookies.