Report #17

Description

Issue description When attempting to log in, the login form displays an error message “Session expired” immediately (or after submitting credentials), and the user cannot complete authentication. The form remains on the login page with the error shown under the password field, indicating the login flow is incorrectly treating the attempt as an expired/invalid session instead of performing a normal sign-in. Expected behavior If the user is not logged in, submitting valid email + password should create a new authenticated session and redirect the user to their account/dashboard. “Session expired” should only appear when a previously valid session/token is no longer valid and the system requires re-authentication (e.g., when accessing a protected page), not as a generic login failure message. Invalid credentials should show a clear “invalid email/password” type message (not “session expired”). Acceptance criteria Logging in with valid credentials succeeds and redirects to the expected authenticated destination. Logging in with invalid credentials shows an “invalid credentials” message (or equivalent), not “Session expired.” If an existing session is expired, the app: clears the expired session state, and allows the user to log in successfully on the next submit. The “Session expired” message only appears when: a protected resource is accessed with an expired token/session, or a refresh-token/session-renewal attempt fails due to expiration. Refreshing the login page does not preserve/rehydrate a stale “expired session” state that blocks login.