Verified directly against the appliance — no passwords.

Operator sessions live in memory only — a reload asks again. Viewer (read-only) wall tokens persist on this screen.