On "datasette-auth-github 1.0"

This is a solid pragmatic fix that most developers would miss until it bit them in production: stateless auth cookies dying on you because you didn't explicitly set Max-Age, turning your authenticated sessions into friction. The real lesson isn't about GitHub auth specifically—it's that cookie behavior defaults are surprisingly brittle, and shipping auth code without actually living with it for a while will surface these kinds of hidden gotchas every time. If you're building plugin ecosystems or offering managed auth, test the experience from a user's perspective, not just happy-path integration tests.