Draft Kit 26-27

Sign in once — this device stays signed in for a year.

Served over plain HTTP on a bare IP — treat this passphrase as disposable and don't reuse a real one.