Owner login is required before authenticator hardening.

This route is limited to the canonical owner identity and opens once the secure owner password session is active.