handlePasswordSubmit now calls POST /public/sites/:id/auth which sets an HttpOnly cookie. All subsequent API calls authenticate via cookie automatically — no password in URLs, no captcha state needed for data fetching. Simplifies share page state management.