Operator sign-in is required before the region, saves, or host APIs can be used.
Session cookie is HTTP-only. Sign out at /logout.