copilot-swe-agent[bot]
3aa5364e0c
The common.js fetch('/api/auth/whoami') probe on every page load was
overwriting the redirect_after_login session key with the API endpoint URL.
After login, users were sent to the JSON endpoint instead of the original page.
Fix: require_login now returns HTTP 401 for any /api/* path, consistent
with REST conventions, and never stores API URLs as the post-login redirect.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>