Public dashboard endpoints use password auth, not session tokens. A 401 on /public/ should surface to the caller (for password prompt), not trigger a token refresh that fails and shows "Session expired".
Public dashboard endpoints use password auth, not session tokens. A 401 on /public/ should surface to the caller (for password prompt), not trigger a token refresh that fails and shows "Session expired".