> Which makes me ask why your main auth cookie is set to None? I've seen things man... scary things where people do iframe mashups and other nonsense. But specifically for IdentityServer it's needed for JS clients doing authorization in iframes for silent token renewal.