Sessions

Use opaque random session tokens stored as hashes in PostgreSQL. Do not use stateless JWT sessions for the Owner dashboard.