Your browser receives a signed HTTP-only session while credentials stay in server environment variables.