Admin sign in

Session uses the HTTP-only tj_session cookie via the same-origin /api/v1 rewrite (credentials: include).