- #427 password sign-in works again. Since 2026-09-08 a correct password
  signed the user in before the CSRF check, Devise then dropped the CSRF
  token, the check failed and the session was thrown away: every sign-in
  landed on the home page signed out, with no message. No migration.