All form configuration, publishing and reporting lives behind this login. Public forms stay reachable without one.
Server-side session & role check — never enforced by the frontend alone.