Not who you're replying to but browsers do way too much. Load the code you're given and don't do anything else.

I think auth is complicated outside of browsers too. But browsers do make some things uniquely confusing, especially cookies and general security primitives are full of footguns