God

Session token is HTTP-only, valid for 7 days,
bound to your IP & user agent. Brute-force attempts
are rate-limited and alerted.