Sessions are server-side and revocable. This app has no password reset — an administrator resets passwords from the Admin tab, and DD_ADMIN_USER / DD_ADMIN_PASSWORD plus DD_ADMIN_RESET_PASSWORD=1 recovers a locked-out administrator on restart.