Session sealed with rotating signature. CSRF double-submit enforced on every mutation. Failed attempts lock the account after 5 strikes.