Sessions are protected with CSRF tokens, device fingerprinting, rotating session IDs and automatic lockout after repeated failed attempts. All activity is written to the security audit log.