What the user should see

• The next time they try to get to a resource...

• They're almost straight in (no need to authenticate again) as there's a cookie kept in the browser.