Sign-in is faster and safer

Sign-in now resists repeated failed attempts with a progressive cool-down, and sessions stay valid for two weeks before you need to sign in again. No action needed — it's all in the background.