Session-Based Authentication in Node.js and TypeScript with HttpOnly Cookies and CSRF Protection

Most authentication tutorials end at "the user is logged in". That is the easy part. The hard part is everything around it: where the password actually goes, where the session lives, what happens when