A secure session token is set as an HTTP-only cookie. /logout clears it.

Accounts are stored in your database. Passwords are hashed server-side. After creating an account you’ll be redirected to sign in.