Enter the owner secret to open a session.
Machine callers keep using Bearer auth — see lib/auth-gate.js.