VideoController constructor applied auth middleware to all methods not in the except list. playerData was missing, causing guest requests to get 401 → SPA fallback to window.location.href → page refresh. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>