AuthRedirectDelegate

final class AuthRedirectDelegate: NSObject, URLSessionTaskDelegate, Sendable

#20857: decides the app's credentials again on every redirect hop. URLSession drops an Authorization header set on the request at the first redirect, even one to the same host, and carries any other header (rpctoken) on to wherever the redirect leads. cp-gatekeeper redirects a protected embed or clip to /cpp/<code>/... on the same host, so without this the Bearer token never reaches the response that matters.