2eef9b2e4a
The /api/ subtree is routed on the main mux, so the browse case in the web ServeHTTP switch was shadowed by the apiRouter catch-all and 401'd. Moved to ServeSharingAPI behind RequireAuth+CsrfProtect, matching /api/storage/. Found by live validation.