Session and login

`me`, `login`, `logout` and the account actions only a signed-in person can take, never an API token.

The operations behind the browser session cookie. For how the cookie itself works, see Authentication.

Queries

me resolves the signed-in identity. Unauthenticated, it resolves null rather than erroring.

mySessions lists the devices currently signed in.

If the account has two-factor authentication enabled, this returns requiresTwoFactor: true and no session.

Completes a login that login left pending on two-factor.

Ends the current session.

Sign a specific device out, or every device except the current one.

These are personal-account actions an API token can never call, see API tokens.