Administrative sign in

This uses a dedicated session cookie and always requires two-factor authentication.