Send X-***-Token on the upload XHR (fixes all uploads failing)

Shipped

July 9, 2026 at 11:31 PM UTC

Author

kamo

Commit

6e41c58

The session moved from a cookie to per-tab sessionStorage (896ea516); window.fetch is monkey-patched to attach X-***-Token to /api/* calls, but the raw XMLHttpRequest used for upload progress is NOT patched — so every upload was unauthenticated (401 -> "Failed to upload background") while every fetch()-based call **************** still worked. Set the header explicitly on the XHR via getSessionToken().