Who is reviewing?
Your name goes on every verdict you record, in the ledger that is the Art. 50 disclosure document. It is held by the server from here on, so nothing in the browser can change it afterwards.
Your password is one person's, not one desk's. Nobody else holds it, changing it changes nothing for anyone else, and whether you can approve takes or file director's notes is decided by your own record — not by the name you type.
Nothing here is a substitute for the transport. Reach this inbox
over https://. Signing in over plain HTTP puts your password on the
wire in clear text, and a session cookie with it.