35ada0e662
The OAuth callback was setting the session cookie on the 'response' parameter but returning a brand new RedirectResponse, causing the cookie to be lost. This created an infinite login loop where the callback succeeded but /auth/me always returned 401. - Set cookies on the RedirectResponse instead of the unused response param - Remove unused 'response: Response' parameter from callback handler - Fixes login loop in production with cross-domain cookies