Sign in with an email code; backend access is granted by role.