This route will hold account, organisation, and session-state controls without leaking that logic into public pages.