- Add getStoredAuthHeader helper that reads charon_auth_token from
localStorage and constructs an Authorization: Bearer header
- Apply the header to all page.request.* API calls in readImportStatus
and issuePendingSessionCancel
- The previous code relied on the browser cookie jar for these cleanup
API calls; with Secure=true on auth cookies, browsers refuse to send
cookies over HTTP to 127.0.0.1 (IP address, not localhost hostname)
causing silent 401s that left pending ImportSession rows in the DB
- Unreleased sessions caused all subsequent caddy-import tests to show
the pending-session banner instead of the Caddyfile textarea, failing
every test after the first
- The fix mirrors how the React app authenticates: via Authorization
header, which is transport-independent and works on both HTTP and HTTPS
GitHub Actions