The login token and role were stored in sessionStorage, which is isolated per tab, so opening a second tab forced a fresh password login. Switch every token/role read and write to localStorage so all tabs on the same origin share the session and a new tab auto-resumes it on load. Expiry (device_list ok:false) and explicit logout still clear it as before. Co-Authored-By: deepseek-v4-pro