Demo data — reloading resets this client-side demo. Not an authorization boundary.