Admin login

The API key is kept in the encrypted server session and is never placed in a URL.