Protected by DOO. Access codes are verified server-side and never stored in the browser.