v0.25.2

src/admin/web/app/runtime.js

@@ -4,12 +4,14 @@
         // app.js belongs to the authenticated shell and must not fall back to its
         // legacy embedded sign-in form when another startup step fails.
         const info = await api("/api/auth/session");
+        clearInvalidOriginRecovery();
         await loadLanguages();
         setupRequired = false;
         translate();
         syncAuthForm();
         await activate(info);
     } catch (e) {
+        if (recoverInvalidOrigin(e)) return;
         if (e.status === 401) {
             location.replace(`${location.pathname}${location.search}`);
             return;