Secure-by-default token-handler BFF: server-side OAuth2 login, session-held tokens, opaque __Host- cookie, per-user authorized-client manager for gateway TokenRelay, cookie-mode CSRF, RP-initiated logout and an XHR-aware authentication entry point. Spring-Cloud-Gateway-agnostic.