Does a Railway-hosted app inherit The Force's Auth0 session with no second login?
Clear this app's session only wipes this app's token cache but leaves the Auth0 tenant session intact — reproducing a user's very first hop from The Force. That is the case that must stay silent, and the only one that actually tests the same-site iframe path.