Authorize

Stored only in this browser tab (sessionStorage) — sent directly to the API, never to us.