A starting point

Sign-in, sign-up, MFA, and password recovery are wired up through Cognito behind a branded login page. Tokens live in httpOnly secure cookies and role membership comes from Cognito groups.