There is no real sign-in yet. This mints a session for the seeded owner and puts it in an httpOnly cookie — the token never reaches the page, because it authorises every human-only act in the product: approving a specification, confirming a criterion, deciding scope, changing a score, moving a stage.