"manual login flow yields authenticated TRUE on success"
"login fails when introspection validation fails"
"auto_redirect triggers when unauthenticated and cookie present"
"authenticated becomes FALSE for expired token (default mode)"
"reauth_after_seconds makes authenticated FALSE when max age exceeded"
"authenticated flips FALSE after expiry without poking reactive values"
"authenticated flips FALSE after reauth_after_seconds without poking"
"authenticated TRUE for token with NA expires_at (no expiry)"
"authenticated TRUE for token with Inf expires_at"
"authenticated FALSE when error is set (default mode)"
"authenticated FALSE when token is cleared"
"authenticated correct at exact expiry boundary"
"indefinite_session keeps authenticated TRUE even when expired or error"
"provider error in query sets error and authenticated FALSE"
"Expected clearQueryAndFixTitle on provider error response"
"oversized callback query params are rejected"
"oversized raw callback query string is rejected"
"callback code/state clears query even when token exchange fails"
"Expected clearQueryAndFixTitle on token-exchange error"
"strip_oauth_query removes only OAuth params"
"oauth_module_server clears token and sets error when proactive refresh fails"

callback code/state clears query even when token exchange fails