Authorized users only - attempts are logged and rate-limited.