I Thought My Next.js 16 Auth Was Solid. One Afternoon Proved Otherwise.

A few months ago I was doing a final pre-release review on a client project before handing it over. Protected routes were protected. Unauthenticated users got redirected. Tokens expired correctly. I had tested it three different ways and everything held up. I was confident enough to stop thinking ab