Security first in auth flows

Prioritize correctness and security in authentication, session, token, and cookie handling over style. Flag missing or weakened validation, auth bypasses, token or session leakage, and unsafe cookie attributes with high priority.