Data security

Draft for review: authorization, session controls and request limits protect access. Production settings, backups and incident response require operational verification.