The 401 that never got to happenA browser will not attach a bearer token to a page navigation. Swapping the header for a cookie the framework already understood, without weakening it.
