Operator access only. The browser receives a short-lived HttpOnly admin session after password verification.