When getUser() rejects a present session cookie with user_not_found /
session_not_found / bad_jwt (e.g. a deleted account or a cookie that
outlived its session), the middleware now clears the sb-*-auth-token
cookies and redirects to /login instead of leaving the browser wedged
in a logged-out page that still renders a Sign out button.
The defense-in-depth admin guard in middleware short-circuits before the
route handlers' jsonNoStore runs, so its 401/403 JSON denials (and auth
redirects) were served without Cache-Control: no-store. Stamp no-store in
withCookies so every admin deny/redirect response is non-cacheable,
completing Finding #4 for the middleware-originated admin responses.
Gerhard Scheikl