Accounts are stored by this MonstarX instance. Passwords are hashed; sessions are cookies.