user, uid 2)Internal RatDesk helpdesk. Everything is in the nav - plus an admin console that is not linked. Your session is a JWT: the signing key is weak, the verifier honours alg:none, and it will load a signing key from a kid header path you control. Become role:admin however you like.