The sign-in form submits to /login, which answers with a redirect to the owner's authorization server. CSP form-action also governs where a form submission redirects, so form-action 'self' made the browser block that redirect. It is now form-action 'self' https:. The header test asserts it.
🤖 Generated with Claude Code