Production path: password auth plus server-side membership and active-location checks.