Hand over a password-protected document (C1). Deliberately no token and no cookie: a reload asks again. Drill-down costs nothing extra — the whole document is already in the reader's memory — so the only thing a session would buy is skipping the prompt after a refresh, which is not worth a second credential living in the browser.

Rate-limited per IP like the publish route, on top of argon2's own cost.