TL;DR — Fitz has @auth_provider / @authenticated for Bearer-token APIs, but a browser admin panel needs something different: the browser can't send an Authorization header on a page navigation or a WebSocket handshake, and an unauthenticated request should redirect to /login , not return a JSON 401. So the flagship Admin app uses a session cookie : login verifies the password with Argon2id , signs a JWT , and puts it in an HttpOnly cookie; every protected page reads the cookie,...