The TOKEN cookie set by UniFi OS includes the 'Partitioned' attribute
(CHIPS), which some libcurl versions do not write to the Netscape cookie
jar file. This caused every API request to go out unauthenticated,
resulting in 401/403 errors even after a successful login.
Fix: extract the TOKEN value directly from the Set-Cookie response
header in login() and pass it via CURLOPT_COOKIE in apiRequest(),
bypassing the broken file-based cookie jar. Cookie file remains as
fallback for environments where extraction fails.
Also update test.php section 8 to validate this fix and show the
extracted cookie value.
https://claude.ai/code/session_01UsuvFAmmeagtQa14QA4iaq
Shows raw login HTTP code, all response headers, X-CSRF-Token extraction
(header + cookie file fallback), login response body, cookie file contents,
and a follow-up stat/voucher GET to verify the full auth+API flow.
https://claude.ai/code/session_01UsuvFAmmeagtQa14QA4iaq
