Security note: login attempts are rate-limited and successful authentication rotates the PHP session identifier.