One session, every product. The apps are routes now, not iframes.
Single-use and expires in 15 minutes.
