These rules apply to all frameworks below unless explicitly called out as a minimal deviation.
GET /login — render login page (server-side template + layout)POST /login — validate credentials, start server-side sessionGET /app — protected page (requires session)POST /logout — destroy sessionPOST /login uses application/x-www-form-urlencoded
username, passwordPOST /logout uses application/x-www-form-urlencoded (can be empty)GET /login
200 OK HTMLPOST /login
303 See Other → Location: /app (sets session cookie)401 Unauthorized HTML (re-render login with error)400 Bad Request HTML if missing/invalid fieldsGET /app
200 OK HTML303 See Other → /loginPOST /logout
303 See Other → /login (clears session)HttpOnly, and Secure in production.