Private instance · sessions are signed cookies · passwords stored as bcrypt hashes