This route uses a separate owner token and an HttpOnly signed session cookie. Replace it with passkey/SSO + MFA before launch.