Use email and password. Sessions use Supabase Auth cookies.