Note: accounts are now handled by a real server with hashed passwords and secure sessions. Before opening this to real students, make sure the server is deployed behind HTTPS in production — cookies are only marked secure automatically when the server runs with NODE_ENV=production.