Sign in
The access token stays in memory. The refresh token is stored in an httpOnly cookie.
Email
Password
Sign in
Administrator sign-in uses a separate httpOnly session.