Protected by HTTPS, a secure session cookie, origin checks and login rate limiting.