Bound unauthenticated sign-in requests and require active sessions for browser-served account images.
Keep live updates authenticated without exposing session material in request URLs, and apply conservative response protections without restricting existing WebUI assets.