This private admin entry point is protected by strict session cookies, route guards, CSRF safeguards, and rate limiting (5 attempts/min per IP).