Yepoleb: I actually pushed it to the server, but template caching got me. Thanks for the hint!
yw :)
Since you're currently active: I just discovered that
friends search works with Bearer authentication as long as you add a cookie containing csrf=true. (At least on www.gog.com; embed.gog.com is only giving me 401 errors.) Is that documentation still something you ever spend time on (commit history suggest not) ;) and if so, is that something you feel worth adding? (I spent far too long trying to figure out why my initial in-browser test with Authorization from several months ago worked, but my code failed, until I
finally discovered that cookie as the missing header.)
Anyway, no worries if not, since now it's at least documented right here.