34e7b9dfa8
Profile page showed "Not Authenticated" because fetch calls to /api/auth/me and /api/auth/change-password were missing credentials: 'same-origin', preventing HttpOnly cookies from being sent.