Sign in to the demo app.

This is separate from the game. It starts vulnerable, then you can harden it live to compare session-cookie behavior.