One door for both sides: the operator reaches the whole book, a carrier reaches only their own. The session is a signed, httpOnly cookie valid for one working day, and nothing behind it opens without one.