POST /wrong/login                            -> Set-Cookie: role=customer; path=/
GET /wrong/staff  Cookie: role=customer      -> 403
GET /wrong/staff  Cookie: role=staff         -> 200 Staff area: today's takings.
POST /right/login                            -> Set-Cookie: PHPSESSID=<random>; path=/; HttpOnly; SameSite=Lax
GET /right/staff  with that session          -> 403
GET /right/staff  session + role=staff       -> 403
