ProtectedauthTutti authenticates with the session token in X-Tutti-Auth (NOT a Bearer
header — that is only used once, to mint this token via authenticateJWT).
Headers for every request. Called per request so auth changes apply at once.
Persist a (possibly logged-in) account; restore with Session.fromJSON.
Staticfrom
Per-account state and the single source of request headers. One Session = one account; construct several for several accounts.