Studio access
Local mock mode uses a signed httpOnly session cookie to protect the studio and admin APIs.