The form never fakes a session

Sign-in verifies the password. It does not invent a browse session.

Kumir never invents a successful login cookie. Auth.js credentials and POST /api/v1/auth/login verify the password before any session is stored.

Landing on /business/browse after a failed password is not a fake session.