MaxerAdmin

This login gates the page, not the data.The same token authenticates every call to the backend, and it is sent from this app’s server — it never reaches your browser. The session cookie holds a hash of it, so rotating the secret signs everyone out.