Server-side access gate. All dashboard, API, PDF, export, Plaid, bank, and tax routes require this session.