Password is set via the APP_PASSWORD environment variable. First sign-in claims this browser's session as the operator account; future sign-ins from any browser map to the same portfolio.