Login broken on 3DS

### Describe the bug
On the 3DS's VERY old web browser attempting to log in shows the successful login redirect page, but then goes back to the login page. It never stays logged in. Using "?pw=foo" kind of works, but logs out on any page load so not really. The ?pw thing also gives a popup saying "could not list files in folder: error 403 access denied try pressing F5, maybe you got logged out" which is strange because it does list the files.

### To Reproduce
1. use a 3ds
2. log in

### Server details (if you're NOT using docker/podman)
Latest sfx (1.20.14)
As a systemd service
* run copyparty with `--version` and grab the last 3 lines (they start with `copyparty`, `CPython`, `sqlite`) and paste them below this line:
```
copyparty v1.20.14 "sftp is fine too" (2026-04-24)
CPython v3.11.2 on Linux64 6.12.75 [GCC 12.2.0]
sqlite 3.40.1*1 | jinja 3.1.2 | pyftpd 1.5.10 | tftp 0.4.0 | miko (None)
```
* **copyparty arguments and/or config-file:**
```
[global]
p: 8086, 3939 # listen on ports 8086 and 3939
e2dsa # enable file indexing and filesystem scanning
e2ts # and enable multimedia indexing
z, qr # and zeroconf and qrcode (you can comma-separate arguments)
cookie-lax
no-bauth

# create users:
[accounts]
rat: BAR # username: password
admin: BAZ
creature: QUUX

# create volumes:
[/] # create a volume at "/" (the webroot), which will
/home/FOO/Copyparty/root
accs:
A: admin # all

# let's specify different permissions for the "priv" subfolder
# by creating another volume at that location:
[/stache_stash]
/home/FOO/Copyparty/root/stache_stash
accs:
rwm: rat
A: admin

[/public]
/home/FOO/Copyparty/root/public
accs:
rwm: rat
A: admin
r: *

[/creatures]
/home/FOO/Copyparty/root/creatures
accs:
rm: creature
wGd: creature
A: admin
```

### Client details
if the issue is possibly on the client-side, then mention some of the following:
* the device type and model:
New 3DS XL
* OS version:
Newest one
* browser version:
1.12.10178

### Server log
if the issue might be server-related, include everything that appears in the copyparty log during startup, and also anything else you think might be relevant

Logs after typing in password:
```
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.114 172.59.155.129 41796 LOG: POST /stache_stash/UNRATLATED/DUNKING%20A%20BASKETBALL%20ON%20ICE%20SKATES.webm @*
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.114 172.59.155.129 41796 LOG: `-- 'stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796 LOG: boundary='----WebKitFormBoundarypniTjM4FOrDIM1vV'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796 LOG: 'Content-Disposition: form-data; name="act"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796 LOG: 'Content-Disposition: form-data; name="cppwd"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796 LOG: 'Content-Disposition: form-data; name="uhash"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.305 172.59.155.129 41796 LOG: GET /favicon.ico @*
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796 LOG: GET /stache_stash/UNRATLATED/DUNKING%20A%20BASKETBALL%20ON%20ICE%20SKATES.webm @*
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796 LOG: `-- 'stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796 LOG: @* has no access to '/stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.676 172.59.155.129 38352 LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.702 172.59.155.129 38355 LOG: AES256-GCM-SHA384 TLSv1.2 256
```

Logs after loading site with ?pw:
```
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.123 172.59.155.129 4496 LOG: shut(28): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.131 172.59.155.129 31640 LOG: shut(8): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.132 172.59.155.129 1162 LOG: shut(29): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.134 172.59.155.129 1386 LOG: shut(30): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.772 172.59.155.129 14745 LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.873 172.59.155.129 14745 LOG: GET /stache_stash/UNRATLATED/?pw= rat @rat
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.405 172.59.155.129 11250 LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.418 172.59.155.129 58906 LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.433 172.59.155.129 38555 LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:55 raspberrypi copyparty[10024]: 21:53:55.093 172.59.155.129 58906 LOG: GET /?setck=js=y @*
May 23 21:53:55 raspberrypi copyparty[10024]: 21:53:55.604 172.59.155.129 38555 LOG: GET /stache_stash/UNRATLATED/?ls @*
```

### Additional context
I've tried the cookie-lax and no-bauth options and they didn't work :(. I'm guessing it's a cookie issue but I'm not sure

检查 copyparty 代码库中的登录流程和 Cookie 处理，重点可能在 HTTP 服务器和身份验证模块。Issue 提到 cookie-lax 和 no-bauth 选项无法正常工作，因此请检查 Cookie 的设置和验证方式，尤其是在 3DS 等旧版浏览器上的情况。检查服务器日志中的身份验证失败以及会话持久性。使用 3DS 浏览器模拟器或类似的旧版浏览器进行测试，以重现重定向和注销行为。

由索引模型根据 Issue 内容生成。