The form never fakes a fan session

Sign-in verifies the password. It does not mint a home session.

Kumir never invents a successful fan cookie. Auth.js credentials and POST /api/v1/auth/login verify the password before any session is stored.

Landing on home after a failed password is not a fake session.