Session persists for 7 days. Rate-limited to 5 failed attempts per 15 minutes.