The /admin guard always read the `__Secure-` session cookie, but Auth.js
only uses that name when AUTH_URL (or the request) is HTTPS. With an
http:// AUTH_URL a signed-in admin was bounced between /admin and /login
until the browser threw "too many history calls". The guard now picks the
cookie name the same way Auth.js does.
The CSP also sent `upgrade-insecure-requests` to plain-HTTP visitors, so
the browser rewrote same-origin fonts/scripts to https:// where nothing
listens. It is now only sent when the visitor reached us over HTTPS.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SimoandClaude Opus 5.5