Release v2.22.4

Fixed

• An expired session no longer strands a single-page app mid-use. Every unauthenticated request used to get redirected to the sign-in page, even a frontend's own fetch()/XHR call - the browser followed that redirect silently and handed the caller a plain 200 login page instead of a clear refusal, so a command kept failing without explanation and an identity check could crash trying to parse the page as JSON. A caller that is not navigating a browser now gets a 401 it can act on; an actual page load still redirects to sign-in as before.