Sessions are cookie-based and re-verified on every request. Approvals require step-up authentication.