Secure Login System

• Passwords are hashed using bcrypt algorithm
• Database stores password hashes (not plain text)
• Password verification uses timing-attack safe methods
• All sessions are protected against hijacking