Restricted operations
Administrative sessions use a separate cookie and require a configured TOTP device.