Move the '..' detection to operate on the raw path string before normalization, ensuring path traversal attempts are caught even when normpath would collapse them. Also apply the same early check to api_parsed_url.path in proxy_request, preventing bypass via normalized path segments.
The notification item component was incorrectly accessing `notif.username` directly instead of `notif.username.name`, causing undefined values to appear in the notification display when the username field contained an object with a `name` property. Added a console.info statement for debugging and corrected the property chain to properly extract the display name from nested object structures.
- Add notifyAuthChange() call after successful token validation in setAuthFromToken
- Fetch user profile during login to obtain canonical username instead of using raw input
- Update both authData and currentUser objects with resolved username from profile API
- Handle profile fetch failure gracefully by falling back to provided username
