// the cookie is HttpOnly and lasts 90 days, so the phone stops asking. Set the secret with wrangler secret put ADMIN_TOKEN.