Account and security

Account settings are surfaced locally here so the user does not hit a dead-end redirect. The actual session authority still lives in SSO, but this page now explains the handoff and gives clear next actions.