Real authentication — password never stored in plaintext, sessions backed by SQLite, account lockout after repeated failures.