Added hadValidSessionRef to track whether the user was ever authenticated during this page load. setSessionExpired() in silentRefresh now only fires when the ref is true, preventing the alert on direct visits by unauthenticated users. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>