POST /wrong/login                            -> Set-Cookie: role=customer; Path=/
GET /wrong/staff  Cookie: role=customer      -> 403
GET /wrong/staff  Cookie: role=staff         -> 200 Staff area: today's takings.
POST /right/login                            -> Set-Cookie: session=eyJyb2xlIjoiY3VzdG9tZXIifQ.<time>.<signature>; HttpOnly; Path=/
  the payload decodes to                     -> {"role":"customer"}
GET /right/staff  with that session          -> 403
GET /right/staff  forged payload             -> 403
