Platform staff sign-in. Two-factor authentication is required for super admins.
Session held in an HttpOnly cookie. Access tokens never reach the browser.