Set ADMIN_PASSWORD and ADMIN_SECRET in the environment. The session lives in one secure cookie for 30 days.