Adding a javasciptKey results in all requests failing as unauthorized

I have a functioning Parse Server up and running and an iOS app successfully accessing it. Everything has been running well for a couple of years.

I didn't add a javascriptKey when setting up the server, but want to add one now to support some web development. However, adding this key to my server configuration via index.js results in all requests from the app failing as unauthorized. It is something specific about the javascriptKey property, since adding a javascriptKey2 instead does not produce the issue. It seems like the server is expecting some additional authorization to be sent by the iOS app when there is a javascriptKey set on the server, but the iOS app doesn't know or care about any javascriptKey. I'm not even sure it is possible to set a javascript key via the iOS SDK.

There is no logging from the server for this. I can run the server locally and nothing is logged when the failed request is returned.

Steps to reproduce:

1. Set up a Parse Server without a javascriptKey and confirm that your app can access it.
2. Add a javascriptKey to the server.

Expected: the app continues to access the server as before.

Actual: all requests fail as "unauthorized"

I am on Parse Server 4.2.0. I couldn't find any mention of this issue in any releases since (or previously) then so am hopeful there is
a common solution that doesn't involve upgrading to 5.x quite yet!

var api = new ParseServer({  
  databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
  cloud: process.env.CLOUD_CODE_MAIN || __dirname + '/cloud/main.js',
  appId: process.env.APP_ID || 'myAppId',
  masterKey: process.env.MASTER_KEY || '',
  serverURL: process.env.SERVER_URL || 'http://localhost:1337/parse', 
  javascriptKey: '123',
  appName: '<App Name>',
  publicServerURL: process.env.SERVER_URL || 'http://localhost:1337/parse',
 
  ...

}

Start with the index.js ParseServer configuration shown in the issue and reproduce the behavior on Parse Server 4.2.0 using an iOS request, first without and then with javascriptKey. Trace the authorization response and compare the relevant server configuration and request handling. Done means identifying the cause and providing a fix or documented compatible behavior so existing iOS requests remain authorized.