Operator sign-in

Private admin needs authentication, roles and an audit trail before it can be enabled. It isn't connected yet.