for local users, or redirecting to IndieAuth server and persisting transient state
in session cookie.
- `getAdminIA` interprets the returning redirect from the IndieAuth server.
+- `getAdminSettings` renders the HTML account settings form
+- `postAdminSettings` ingests and acts on account updates
+
+### Helpers
+
+- `sessionNavLinks` call from app templates to populate navLinks for account settings and logout
### Other Notes
+For the moment, this imposes a web structure of /admin/* for authentication management paths.
+
The logger used should be able to mask these context fields:
- `ctx.parsedBody.credential`