Login expectations

• only verified accounts can log in
• successful login creates a secure session cookie
• your session persists across page refreshes until you log out