Sign in (unprotected origin)
Before state — a breached-but-valid password still gets a session.
Email
Password
Sign in
Seed: Alice
password
(breached) authenticates here. Compare with the capability host login for the fixed path.