[bug] KOReader Sync: /users/auth/ endpoint always redirects to /login, ignoring Basic Auth and x-auth headers

[crocodilestick]

Summary

The KOReader Sync auth endpoint (/users/auth/) unconditionally 302-redirects to /login regardless of authentication method used. This breaks all KOReader and Crosspoint clients that authenticate via Basic Auth or x-auth headers — even though the same credentials work fine against OPDS.

Reproduction

# Basic Auth (should work, doesn't)
curl -v -u 'USER:PASS' -H "Accept: application/vnd.koreader.v1+json" "https://<host>/users/auth/"
# → HTTP/2 302, redirects to /login?next=%2Fusers%2Fauth%2F

# Legacy kosync headers (should work, doesn't)
curl -v -H "Accept: application/vnd.koreader.v1+json"   -H "x-auth-user: USER" -H "x-auth-key: MD5HASH"   "https://<host>/users/auth/"
# → Same 302 redirect

Expected behavior

The endpoint should accept Basic Auth and x-auth headers (like OPDS does) and return 200 with auth data, not redirect to the web login page.

Environment

• CWA v4.0.6
• KOReader 2026.03+
• Affects both direct access and reverse-proxy setups

Related (consolidated from)

• KOReader sync not working - Authentication error/redirecting to login page #1278 — KOReader sync not working - Authentication error/redirecting to login page
• KOReader Sync (/users/auth/) always redirects to /login, ignoring Basic Auth and x-auth headers #1460 — KOReader Sync (/users/auth/) always redirects to /login, ignoring Basic Auth and x-auth headers