Protected service pages, cart actions, profile access, and admin controls all use Discord OAuth2 with a server-created local session.