Since the api calls the standard login controller https://github.com/NodeBB/NodeBB/blob/master/src/controllers/write/utilities.js#L32 it behaves the same as someone going to /login and logging in.
Switched theme, rebuild, reload and all of a sudden it's:
Invalid Session It looks like your login session is no longer active. Please refresh this page.
Was logged in in two tabs as same user beforehand, logged out on one, the other shows the error upon navigating to "/login".
Navigating to a custom template, I first get a basic auth prompt although already authenticated. Once reauthenticated I get the template (rendered as opposed to white canvas as I was getting previously, not sure why it is so now). Then a Shift-R gets me the invalid session error again.
I'm in the process of creating a new theme and removed /home and /homepage routes temporarily, templates remain. Achieved this by activating custom pages and custom homepage plugin, setting up route for a custom homepage and for debugging disabled all plugins again. Rebuild and reload done for each step.
This should invalidate sessions though not leading to a repeating "Invalid session"-loop. It seems I'm getting quite inconsistent behaviour from nodebb with my setup, for various reasons.
Shift-R doesn't help either. Closing tab and opening a new one won't help. This is happening across browsers, chrome and FF tested.