Restricted area. Session is HttpOnly and CSRF-protected; sign-in attempts are rate-limited and audited.
