Operator console

Sent once to the console over HTTPS; this browser then keeps a session cookie, not the token.