Cookie monster.

Acme's developers shipped a staff portal before the security review. The admin notes are supposedly restricted to administrators.

You recovered a copy of the page (portal.html). Serve it locally and see whether "restricted" really means anything:

python3 -m http.server 8000
# then open http://localhost:8000/portal.html

Browsers don't keep cookies for file:// pages, so use the local server.