Reuses authn's session. Admin credentials post to this BFF only; the internal API key stays on the server and the session uses an HttpOnly cookie. After signing in you are returned to the Library page.