init session...
authenticate
step 1 / 2 — credentials
verify
step 2 / 2 — totp code
reset password
verifying token...
welcome
session active
add passkey
register a passkey for this account
passkeys let you sign back in without typing your password if your browser drops the cookie