But my use case is more external-facing.
So the only thing you can rely on is what the browser sees — HTML, DOM, JS. In that context, unexpected DOM changes (like a hidden login form reappearing, or a 403 turning into a 200) can be quite telling.
What do you think?