Could not load security token
Before upload/copy/remote actions, the page loads a CSRF token from /api/auth/csrf. If that fails, you see Could not load security token.
Why this happens
The client calls GET /api/auth/csrf with cookies. A non-OK response or a JSON body without token triggers this message. Typical causes: session expired, cookies blocked, wrong site URL / HTTPS mix, or the auth route erroring behind a proxy.
Diagnose and fix
1. Hard refresh and sign in again, then open the upload page.
2. Allow cookies for the site; disable strict blockers for this domain.
3. Confirm members use the real public URL (PUBLIC_APP_URL / HTTPS) — not http:// on an HTTPS-only cookie setup.
4. In the browser Network tab, inspect /api/auth/csrf — status should be 200 with a token field.
5. On the server, check app logs for CSRF/session errors; confirm the app process is healthy: systemctl status xfileultra.