Could not load security token — refresh the page
Login, register, contact, report-abuse, checkout, and similar clients call GET /api/auth/csrf. On failure they show Could not load security token. Refresh the page. (errors auth.csrfLoadFailed).
Why this happens
Same CSRF endpoint as upload’s shorter Could not load security token article — this string is the auth/public variant that explicitly asks to refresh. Causes: cookies blocked, session/proxy issues, or /api/auth/csrf erroring.
Diagnose and fix
1. Hard refresh; allow cookies; retry on the real site URL over HTTPS.
2. Network tab: confirm /api/auth/csrf returns 200 + token.
3. Sign in again if the session cookie was cleared.
4. Admin-only helpers use Could not get CSRF token / Could not load CSRF token instead.