POST /wrong/login                            -> Set-Cookie: role=customer; Path=/
GET /wrong/staff  Cookie: role=customer      -> 403
GET /wrong/staff  Cookie: role=staff         -> 200 Staff area: today's takings.
POST /right/login                            -> Set-Cookie: SID=<random>; Path=/; HttpOnly; SameSite=Lax
GET /right/staff  with that session          -> 403
GET /right/staff  session + role=staff       -> 403
