Refresh the page and try again
Forgot-password / reset-password (and similar) show Refresh the page and try again. when CSRF failed to load or is not ready at submit (auth.refreshAndRetry).
Why this happens
GET /api/auth/csrf failed in the form’s effect, or submit ran with an empty token. Sibling of longer Security token not ready… / Could not load security token — refresh the page wordings.
Diagnose and fix
1. Hard refresh; allow cookies; retry on HTTPS.
2. Network: confirm /api/auth/csrf returns 200 + token.
3. Sign in / open the form again if the session cookie was cleared.
4. If CSRF loads but POST fails validation, see Invalid CSRF token.