The login page is the browser's own dialog

The client wants the weekly numbers as a page, not a PDF. They want it private. They do not want an account, a login form, or one more entry in their password manager.

One line above the handler: // @token 7f3k-…. You send them the URL. The browser gets a 401 with a WWW-Authenticate header and opens its own password dialog. Any username, that token as the password, and the page loads. The same endpoint answers curl -u :7f3k-… from their analyst's laptop and Authorization: Bearer from a script. The comparison is constant-time, the token shows as [REDACTED] in every log, and a ?token= arriving in the query string is stripped from req.url before your code sees it.

No sessions, no auth library, no form to style. The password dialog every browser already ships is the login page.