VideoController constructor applied auth middleware to all methods not in the except list. playerData was missing, causing guest requests to get 401 → SPA fallback to window.location.href → page refresh. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>