Error 401 while logging in

[unguest]

Calls to the root domain to log in are SSOed, thus blocking the login operation :

XHRGET
https://pad.acme.com/block/Y1/REDACTED
[HTTP/2 401  43ms]

GET
	https://pad.acme.com/block/Y1/REDACTED
Status
401
VersionHTTP/2
Transferred1.32 kB (40 B size)
Referrer Policystrict-origin-when-cross-origin
DNS ResolutionDNS over HTTPS


    access-control-allow-origin
    	https://sandbox.pad.acme.com
    cache-control
    	no-cache
    content-length
    	40
    content-security-policy
    	default-src 'none'; child-src https://pad.acme.com; worker-src 'self'; media-src blob:; style-src 'unsafe-inline' 'self' https://pad.acme.com; script-src 'self' resource: https://pad.acme.com; connect-src 'self' blob: https://pad.acme.com https://sandbox.pad.acme.com wss://pad.acme.com; font-src 'self' data: https://pad.acme.com; img-src 'self' data: blob: https://pad.acme.com; frame-src 'self' https://sandbox.pad.acme.com blob:; frame-ancestors 'self' https://pad.acme.com
    content-type
    	application/json; charset=utf-8
    cross-origin-embedder-policy
    	require-corp
    cross-origin-resource-policy
    	cross-origin
    date
    	Sun, 18 May 2025 19:53:05 GMT
    etag
    	W/"28-6UO0hdfHyQxhKPbWQeqjAugh1Dg"
    permissions-policy
    	interest-cohort=()
    server
    	nginx
    strict-transport-security
    	max-age=63072000; includeSubDomains; preload
    x-content-type-options
    	nosniff
    x-download-options
    	noopen
    X-Firefox-Spdy
    	h2
    x-frame-options
    	SAMEORIGIN
    x-permitted-cross-domain-policies
    	none
    x-powered-by
    	Express
    x-sso-wat
    	You've just been SSOed
    x-xss-protection
    	1; mode=block
    	
    Accept
    	*/*
    Accept-Encoding
    	gzip, deflate, br, zstd
    Accept-Language
    	en-US,en;q=0.5
    Connection
    	keep-alive
    Cookie
    	yunohost.portal=REDACTED
    DNT
    	1
    Host
    	pad.acme.com
    Priority
    	u=4
    Referer
    	https://pad.acme.com/login/
    Sec-Fetch-Dest
    	empty
    Sec-Fetch-Mode
    	cors
    Sec-Fetch-Site
    	same-origin
    Sec-GPC
    	1
    TE
    	trailers
    User-Agent
    	Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0