Hardcoded secure: true silently drops the cookie on HTTP (localhost), causing the post-join redirect to bounce back to /login. Use $app/environment dev flag so the cookie works in development while remaining Secure in production. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>