next build bakes NODE_ENV=production into the bundle, so a custom
DEV_MODE env var is used instead. Middleware bypasses auth by hostname
for the dev domain, and getQuestSession returns a mock admin session
when DEV_MODE=true. Login page now uses window.location.href for
full-page navigation to ensure the session cookie is sent.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Change session cookie name from better-auth.session_token to session_token
- Increase rate limit to 100 req/min in development (10 in production)
- Fix DATABASE_URL to use URL-encoded password for special characters
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
