POST /auth/password and /auth/totp answer 401 for a wrong password/code; the global 401 handler treated that as an expired session and redirected to /login. Both mutations now pass noAuthRedirect so the form shows the field error. Co-Authored-By: Claude Opus 5.5 <[email protected]>