HttpOnly sessionBrowser JavaScript does not read the session token.
Same-origin POST checksAuthentication writes are accepted only from the SIGRIVO origin.
Rate limitsRepeated signup and login attempts can be temporarily rejected.
MFA-aware loginTOTP code entry is supported when MFA is already enabled.