Session access is rate-limited and protected by a local challenge.