fix(auth): disable basic token query bypass

Comment out the basic-auth middleware shortcut that allowed any request with a token query parameter to skip the session-cookie check. This keeps unauthenticated direct page loads on the normal login redirect path unless a valid session cookie exists.

Author: adityathebe

middleware.basic.ts

@@ -18,10 +18,11 @@ export default function basicMiddleware(request: NextRequest) {
     return NextResponse.next();
   }
 
-  const token = request.nextUrl.searchParams.get("token");
-  if (token) {
-    return NextResponse.next();
-  }
+  // FIXME: Comment it out. Not sure what this for.
+  // const token = request.nextUrl.searchParams.get("token");
+  // if (token) {
+  //   return NextResponse.next();
+  // }
 
   const hasSession =
     request.cookies.has("ory_kratos_session") ||