Gerhard Scheikl
6e8724c9a4
When getUser() rejects a present session cookie with user_not_found / session_not_found / bad_jwt (e.g. a deleted account or a cookie that outlived its session), the middleware now clears the sb-*-auth-token cookies and redirects to /login instead of leaving the browser wedged in a logged-out page that still renders a Sign out button.