920e43f47f
The dev config uses http://localhost:8080 (plain HTTP), but both session cookies had secure: true, which tells browsers to only send cookies over HTTPS. This caused a sign-in loop where authentication succeeded but the browser dropped the cookie, redirecting back to login. This change sets secure: false for both cookie configurations in the dev config only. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Emily Moir <emi@emimoir.com>