After logout invalidates the session, the SPA still holds the old CSRF cookie. Subsequent login attempts succeed but bootstrap/API calls fail with CSRF mismatch, causing redirect back to login. Fix: fetch a fresh CSRF cookie via /sanctum/csrf-cookie after logout completes.