clawborrator admin
Authorization Code flow — sets a same-origin HttpOnly cookie