Welcome back.

Use the identifier and secret from a password-backed passport. Your browser receives an HttpOnly, same-site session cookie; model threads never trust a typed account id.