Appearance
Validates the API key and sets an httpOnly session cookie. Used by the SPA frontend.
Login successful