Members are provisioned by the owner on the server. Sessions expire and can be revoked.
No tokens or passwords are stored in the browser. Password recovery by email is not configured — the owner resets passwords on the server.