diff --git a/TODO.md b/TODO.md
index 29fec1d1..409986ad 100644
--- a/TODO.md
+++ b/TODO.md
@@ -8,7 +8,7 @@ Order = impact. Font items + app.html preload intentionally skipped.
 - [x] 2. Chart.js dynamic import in `FitnessChart.svelte` (drop 244 KB from non-stats fitness routes)
 - [x] 3. Recipe API endpoints — drop `JSON.parse(JSON.stringify(...))` double-serialize (9 endpoints). Client-side shuffle / cache headers deferred (would require rethinking hero preload + hydration)
 - [x] 4. Favorites page — drop unnecessary `all_brief` fetch (verified Search uses `favoritesOnly` so `allRecipes` was redundant)
-- [x] 5. Replace redundant `locals.auth()` with `locals.session` across recipe/calendar/fitness loaders (loaders only; actions + admin/edit/add pages skipped)
+- [x] 5. Replace redundant `locals.auth()` with `locals.session` across all routes (68 files, 107 sites — loaders, actions, API endpoints)
 - [ ] 6. Stream fitness stats loader — return promises for slow panels
 - [ ] 7. Overview endpoint — add `.select(...)` projection, cap timeseries window
 - [ ] 8. Calendar payload trim — drop `name` from `yearDays`, pre-filter `feastDots` server-side
@@ -27,6 +27,7 @@ Order = impact. Font items + app.html preload intentionally skipped.
 [ ] Make the Period ended button a lot more prominent
 [ ] swap heart emoji on recipe favorites to lucide icon
 [ ] coop and migros cards on shopping list for scanning
+[ ] login icon from lucide in header
 
 ## Refactor Recipe Search Component
 
diff --git a/package.json b/package.json
index 6e212445..99f58745 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "homepage",
-	"version": "1.46.17",
+	"version": "1.46.18",
 	"private": true,
 	"type": "module",
 	"scripts": {
diff --git a/src/lib/server/middleware/auth.ts b/src/lib/server/middleware/auth.ts
index 547c2195..c59651d9 100644
--- a/src/lib/server/middleware/auth.ts
+++ b/src/lib/server/middleware/auth.ts
@@ -31,7 +31,7 @@ export interface AuthenticatedUser {
 export async function requireAuth(
 	locals: RequestEvent['locals']
 ): Promise<AuthenticatedUser> {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	if (!session || !session.user?.nickname) {
 		throw json({ error: 'Unauthorized' }, { status: 401 });
@@ -53,7 +53,7 @@ export async function requireGroup(
 	locals: RequestEvent['locals'],
 	group: string
 ): Promise<AuthenticatedUser> {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	if (!session || !session.user?.nickname) {
 		throw json({ error: 'Unauthorized' }, { status: 401 });
@@ -92,7 +92,7 @@ export async function requireGroup(
 export async function optionalAuth(
 	locals: RequestEvent['locals']
 ): Promise<AuthenticatedUser | null> {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	if (!session || !session.user?.nickname) {
 		return null;
diff --git a/src/lib/server/shoppingAuth.ts b/src/lib/server/shoppingAuth.ts
index 560bf39b..28f23dd3 100644
--- a/src/lib/server/shoppingAuth.ts
+++ b/src/lib/server/shoppingAuth.ts
@@ -12,7 +12,7 @@ export async function getShoppingUser(
   url: URL
 ): Promise<string | null> {
   // Check session first
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (auth?.user?.nickname) return auth.user.nickname;
 
   // Check share token
diff --git a/src/routes/(main)/settings/+page.server.ts b/src/routes/(main)/settings/+page.server.ts
index f1311be4..554fe2ad 100644
--- a/src/routes/(main)/settings/+page.server.ts
+++ b/src/routes/(main)/settings/+page.server.ts
@@ -3,7 +3,7 @@ import type { Actions, PageServerLoad } from "./$types"
 import { error } from "@sveltejs/kit"
 
 export const load: PageServerLoad = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   const user = session?.user ?? null;
 	return {user}
 }
diff --git a/src/routes/[cospendRoot=cospendRoot]/dash/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/dash/+page.server.ts
index 4eaf1bbf..6add194d 100644
--- a/src/routes/[cospendRoot=cospendRoot]/dash/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/dash/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, fetch, url }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/list/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/list/+page.server.ts
index 05a24a70..77022c25 100644
--- a/src/routes/[cospendRoot=cospendRoot]/list/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/list/+page.server.ts
@@ -13,7 +13,7 @@ function serializeItems(items: IShoppingItem[]): ShoppingItem[] {
 }
 
 export const load: PageServerLoad = async ({ locals, url }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   const token = url.searchParams.get('token');
 
   // Allow access with valid share token even without session
diff --git a/src/routes/[cospendRoot=cospendRoot]/payments/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/payments/+page.server.ts
index dce4b8c4..d08f9ca9 100644
--- a/src/routes/[cospendRoot=cospendRoot]/payments/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/payments/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, fetch, url }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/payments/add/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/payments/add/+page.server.ts
index 7e186117..4809f4e3 100644
--- a/src/routes/[cospendRoot=cospendRoot]/payments/add/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/payments/add/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect, fail } from '@sveltejs/kit';
 import { PREDEFINED_USERS, isPredefinedUsersMode } from '$lib/config/users';
 
 export const load: PageServerLoad = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
@@ -18,7 +18,7 @@ export const load: PageServerLoad = async ({ locals }) => {
 
 export const actions: Actions = {
   default: async ({ request, locals, fetch, params }) => {
-    const session = await locals.auth();
+    const session = locals.session ?? await locals.auth();
     
     if (!session || !session.user?.nickname) {
       throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/payments/edit/[id]/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/payments/edit/[id]/+page.server.ts
index 99921c70..3811149d 100644
--- a/src/routes/[cospendRoot=cospendRoot]/payments/edit/[id]/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/payments/edit/[id]/+page.server.ts
@@ -2,7 +2,7 @@ import type { PageServerLoad } from './$types';
 import { redirect } from '@sveltejs/kit';
 
 export const load: PageServerLoad = async ({ locals, params }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/payments/view/[id]/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/payments/view/[id]/+page.server.ts
index 6462d852..df6a8349 100644
--- a/src/routes/[cospendRoot=cospendRoot]/payments/view/[id]/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/payments/view/[id]/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, params, fetch, url }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/recurring/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/recurring/+page.server.ts
index f3c9373c..9b901aa0 100644
--- a/src/routes/[cospendRoot=cospendRoot]/recurring/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/recurring/+page.server.ts
@@ -2,7 +2,7 @@ import type { PageServerLoad } from './$types';
 import { redirect } from '@sveltejs/kit';
 
 export const load: PageServerLoad = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/recurring/edit/[id]/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/recurring/edit/[id]/+page.server.ts
index 9b75be4e..65866e55 100644
--- a/src/routes/[cospendRoot=cospendRoot]/recurring/edit/[id]/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/recurring/edit/[id]/+page.server.ts
@@ -2,7 +2,7 @@ import type { PageServerLoad } from './$types';
 import { redirect } from '@sveltejs/kit';
 
 export const load: PageServerLoad = async ({ locals, params }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[cospendRoot=cospendRoot]/settle/+page.server.ts b/src/routes/[cospendRoot=cospendRoot]/settle/+page.server.ts
index 9a7c96cb..27369520 100644
--- a/src/routes/[cospendRoot=cospendRoot]/settle/+page.server.ts
+++ b/src/routes/[cospendRoot=cospendRoot]/settle/+page.server.ts
@@ -3,7 +3,7 @@ import type { PageServerLoad, Actions } from './$types';
 import { detectCospendLang, cospendRoot } from '$lib/js/cospendI18n';
 
 export const load: PageServerLoad = async ({ fetch, locals, request, url }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session) {
     throw redirect(302, '/login');
diff --git a/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/[[yyyy=calendarYear]]/[[mm=calendarMonth]]/[[dd=calendarDay]]/+page.server.ts b/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/[[yyyy=calendarYear]]/[[mm=calendarMonth]]/[[dd=calendarDay]]/+page.server.ts
index b7497b7a..6baeb45f 100644
--- a/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/[[yyyy=calendarYear]]/[[mm=calendarMonth]]/[[dd=calendarDay]]/+page.server.ts
+++ b/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/[[yyyy=calendarYear]]/[[mm=calendarMonth]]/[[dd=calendarDay]]/+page.server.ts
@@ -291,6 +291,6 @@ export const load: PageServerLoad = async ({ params, url, locals, fetch }) => {
 		todayIso,
 		selected: selectedEntry,
 		selectedIso,
-		session: locals.session ?? (await locals.auth())
+		session: locals.session ?? (locals.session ?? await locals.auth())
 	};
 };
diff --git a/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/detail/[yyyy=calendarYear]/[mm=calendarMonth]/[dd=calendarDay]/+page.server.ts b/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/detail/[yyyy=calendarYear]/[mm=calendarMonth]/[dd=calendarDay]/+page.server.ts
index e3aef489..477de610 100644
--- a/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/detail/[yyyy=calendarYear]/[mm=calendarMonth]/[dd=calendarDay]/+page.server.ts
+++ b/src/routes/[faithLang=faithLang]/[calendar=calendarLang]/[rite=calendarRite]/detail/[yyyy=calendarYear]/[mm=calendarMonth]/[dd=calendarDay]/+page.server.ts
@@ -96,6 +96,6 @@ export const load: PageServerLoad = async ({ params, url, locals, fetch }) => {
 		iso,
 		todayIso,
 		day1: entry,
-		session: locals.session ?? (await locals.auth())
+		session: locals.session ?? (locals.session ?? await locals.auth())
 	};
 };
diff --git a/src/routes/[faithLang=faithLang]/[prayers=prayersLang]/[prayer]/+page.server.ts b/src/routes/[faithLang=faithLang]/[prayers=prayersLang]/[prayer]/+page.server.ts
index b00eb2a1..7fd3098b 100644
--- a/src/routes/[faithLang=faithLang]/[prayers=prayersLang]/[prayer]/+page.server.ts
+++ b/src/routes/[faithLang=faithLang]/[prayers=prayersLang]/[prayer]/+page.server.ts
@@ -54,7 +54,7 @@ export const load: PageServerLoad = async ({ params, url, locals, fetch }) => {
 
 export const actions: Actions = {
 	'pray-angelus': async ({ request, locals, fetch }) => {
-		const session = await locals.auth();
+		const session = locals.session ?? await locals.auth();
 		if (!session?.user?.nickname) {
 			throw error(401, 'Authentication required');
 		}
diff --git a/src/routes/[faithLang=faithLang]/[rosary=rosaryLang]/+page.server.ts b/src/routes/[faithLang=faithLang]/[rosary=rosaryLang]/+page.server.ts
index c1f3bc92..287cde8e 100644
--- a/src/routes/[faithLang=faithLang]/[rosary=rosaryLang]/+page.server.ts
+++ b/src/routes/[faithLang=faithLang]/[rosary=rosaryLang]/+page.server.ts
@@ -105,7 +105,7 @@ export const load: PageServerLoad = async ({ url, fetch, locals, params }) => {
 
 export const actions: Actions = {
   pray: async ({ locals, fetch }) => {
-    const session = await locals.auth();
+    const session = locals.session ?? await locals.auth();
     if (!session?.user?.nickname) {
       return { success: false };
     }
diff --git a/src/routes/[recipeLang=recipeLang]/[name]/+page.server.ts b/src/routes/[recipeLang=recipeLang]/[name]/+page.server.ts
index 9a1c8f98..4e0effa5 100644
--- a/src/routes/[recipeLang=recipeLang]/[name]/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/[name]/+page.server.ts
@@ -33,7 +33,7 @@ export const load: PageServerLoad = async ({ fetch, params, locals, url }) => {
 
 export const actions: Actions = {
     toggleFavorite: async ({ request, locals, url, fetch }) => {
-        const session = await locals.auth();
+        const session = locals.session ?? await locals.auth();
         
         if (!session?.user?.nickname) {
             throw error(401, 'Authentication required');
diff --git a/src/routes/[recipeLang=recipeLang]/add/+page.server.ts b/src/routes/[recipeLang=recipeLang]/add/+page.server.ts
index fd34c6ec..519d8186 100644
--- a/src/routes/[recipeLang=recipeLang]/add/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/add/+page.server.ts
@@ -16,7 +16,7 @@ export const load: PageServerLoad = async ({locals, params}) => {
         throw redirect(301, '/rezepte/add');
     }
 
-    const session = await locals.auth();
+    const session = locals.session ?? await locals.auth();
     return {
 		user: session?.user
     };
@@ -25,7 +25,7 @@ export const load: PageServerLoad = async ({locals, params}) => {
 export const actions = {
 	default: async ({ request, locals, params }) => {
 		// Check authentication
-		const auth = await locals.auth();
+		const auth = locals.session ?? await locals.auth();
 		if (!auth) {
 			return fail(401, {
 				error: 'You must be logged in to add recipes',
diff --git a/src/routes/[recipeLang=recipeLang]/admin/alt-text-generator/+page.server.ts b/src/routes/[recipeLang=recipeLang]/admin/alt-text-generator/+page.server.ts
index 21c6010f..c539ba3a 100644
--- a/src/routes/[recipeLang=recipeLang]/admin/alt-text-generator/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/admin/alt-text-generator/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, url, fetch }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	// Redirect to login if not authenticated
 	if (!session?.user?.nickname) {
diff --git a/src/routes/[recipeLang=recipeLang]/admin/image-colors/+page.server.ts b/src/routes/[recipeLang=recipeLang]/admin/image-colors/+page.server.ts
index 42747afc..e7f9d97f 100644
--- a/src/routes/[recipeLang=recipeLang]/admin/image-colors/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/admin/image-colors/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, url, fetch }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	if (!session?.user?.nickname) {
 		const callbackUrl = encodeURIComponent(url.pathname);
diff --git a/src/routes/[recipeLang=recipeLang]/admin/untranslated/+page.server.ts b/src/routes/[recipeLang=recipeLang]/admin/untranslated/+page.server.ts
index 15dd878a..351e4b49 100644
--- a/src/routes/[recipeLang=recipeLang]/admin/untranslated/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/admin/untranslated/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ fetch, locals, url, params }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	// Redirect to login if not authenticated
 	if (!session?.user?.nickname) {
diff --git a/src/routes/[recipeLang=recipeLang]/administration/+page.server.ts b/src/routes/[recipeLang=recipeLang]/administration/+page.server.ts
index 50191ab9..6b22837a 100644
--- a/src/routes/[recipeLang=recipeLang]/administration/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/administration/+page.server.ts
@@ -3,7 +3,7 @@ import { redirect } from '@sveltejs/kit';
 import { errorWithVerse } from '$lib/server/errorQuote';
 
 export const load: PageServerLoad = async ({ locals, params, url, fetch }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	// Redirect to login if not authenticated
 	if (!session?.user?.nickname) {
diff --git a/src/routes/[recipeLang=recipeLang]/edit/[name]/+page.server.ts b/src/routes/[recipeLang=recipeLang]/edit/[name]/+page.server.ts
index ce54f5b1..7b119b96 100644
--- a/src/routes/[recipeLang=recipeLang]/edit/[name]/+page.server.ts
+++ b/src/routes/[recipeLang=recipeLang]/edit/[name]/+page.server.ts
@@ -68,7 +68,7 @@ export const load: PageServerLoad = async ({ fetch, params, locals}) => {
 
     const apiRes = await fetch(`/api/rezepte/items/${params.name}`);
     const recipe = await apiRes.json();
-    const session = await locals.auth();
+    const session = locals.session ?? await locals.auth();
     return {
 		recipe: recipe,
 		user: session?.user
@@ -78,7 +78,7 @@ export const load: PageServerLoad = async ({ fetch, params, locals}) => {
 export const actions = {
 	default: async ({ request, locals, params }) => {
 		// Check authentication
-		const auth = await locals.auth();
+		const auth = locals.session ?? await locals.auth();
 		if (!auth) {
 			return fail(401, {
 				error: 'You must be logged in to edit recipes',
diff --git a/src/routes/api/[recipeLang=recipeLang]/favorites/+server.ts b/src/routes/api/[recipeLang=recipeLang]/favorites/+server.ts
index 82ec0b8f..2cd19819 100644
--- a/src/routes/api/[recipeLang=recipeLang]/favorites/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/favorites/+server.ts
@@ -6,7 +6,7 @@ import { error } from '@sveltejs/kit';
 import mongoose from 'mongoose';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
@@ -29,7 +29,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
@@ -67,7 +67,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
diff --git a/src/routes/api/[recipeLang=recipeLang]/favorites/check/[shortName]/+server.ts b/src/routes/api/[recipeLang=recipeLang]/favorites/check/[shortName]/+server.ts
index 87a28d7e..cfbb6059 100644
--- a/src/routes/api/[recipeLang=recipeLang]/favorites/check/[shortName]/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/favorites/check/[shortName]/+server.ts
@@ -5,7 +5,7 @@ import { dbConnect } from '$utils/db';
 import { error } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ locals, params }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   
   if (!session?.user?.nickname) {
     return json({ isFavorite: false });
diff --git a/src/routes/api/[recipeLang=recipeLang]/favorites/recipes/+server.ts b/src/routes/api/[recipeLang=recipeLang]/favorites/recipes/+server.ts
index 911e91e7..5e6f271d 100644
--- a/src/routes/api/[recipeLang=recipeLang]/favorites/recipes/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/favorites/recipes/+server.ts
@@ -7,7 +7,7 @@ import { error } from '@sveltejs/kit';
 import { isEnglish, briefQueryConfig } from '$lib/server/recipeHelpers';
 
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
diff --git a/src/routes/api/[recipeLang=recipeLang]/nutrition/[name]/+server.ts b/src/routes/api/[recipeLang=recipeLang]/nutrition/[name]/+server.ts
index d7b59050..cc00b5b9 100644
--- a/src/routes/api/[recipeLang=recipeLang]/nutrition/[name]/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/nutrition/[name]/+server.ts
@@ -9,7 +9,7 @@ import type { NutritionMapping } from '$types/types';
 
 /** PATCH: Update individual nutrition mappings (manual edit UI) */
 export const PATCH: RequestHandler = async ({ params, request, locals }) => {
-	await locals.auth();
+	locals.session ?? await locals.auth();
 	await dbConnect();
 
 	const en = isEnglish(params.recipeLang!);
diff --git a/src/routes/api/[recipeLang=recipeLang]/nutrition/generate/[name]/+server.ts b/src/routes/api/[recipeLang=recipeLang]/nutrition/generate/[name]/+server.ts
index 92b600e3..7b1134c8 100644
--- a/src/routes/api/[recipeLang=recipeLang]/nutrition/generate/[name]/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/nutrition/generate/[name]/+server.ts
@@ -5,7 +5,7 @@ import { isEnglish } from '$lib/server/recipeHelpers';
 import { generateNutritionMappings } from '$lib/server/nutritionMatcher';
 
 export const POST: RequestHandler = async ({ params, locals, url }) => {
-	await locals.auth();
+	locals.session ?? await locals.auth();
 	await dbConnect();
 
 	const en = isEnglish(params.recipeLang!);
diff --git a/src/routes/api/[recipeLang=recipeLang]/search/+server.ts b/src/routes/api/[recipeLang=recipeLang]/search/+server.ts
index 0e3f71fe..af5d3528 100644
--- a/src/routes/api/[recipeLang=recipeLang]/search/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/search/+server.ts
@@ -49,7 +49,7 @@ export const GET: RequestHandler = async ({ url, params, locals }) => {
     let recipes: BriefRecipeType[] = dbRecipes.map(r => toBrief(r, params.recipeLang!));
 
     // Handle favorites filter
-    const session = await locals.auth();
+    const session = locals.session ?? await locals.auth();
     if (favoritesOnly && session?.user) {
       const { UserFavorites } = await import('$models/UserFavorites');
       const userFavorites = await UserFavorites.findOne({ username: session.user.nickname });
diff --git a/src/routes/api/[recipeLang=recipeLang]/to-try/+server.ts b/src/routes/api/[recipeLang=recipeLang]/to-try/+server.ts
index 79d1244d..6d4a20d2 100644
--- a/src/routes/api/[recipeLang=recipeLang]/to-try/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/to-try/+server.ts
@@ -3,7 +3,7 @@ import { ToTryRecipe } from '$models/ToTryRecipe';
 import { dbConnect } from '$utils/db';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.groups?.includes('rezepte_users')) {
     throw error(403, 'Forbidden');
@@ -20,7 +20,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.groups?.includes('rezepte_users')) {
     throw error(403, 'Forbidden');
@@ -51,7 +51,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 };
 
 export const PATCH: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.groups?.includes('rezepte_users')) {
     throw error(403, 'Forbidden');
@@ -96,7 +96,7 @@ export const PATCH: RequestHandler = async ({ request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.groups?.includes('rezepte_users')) {
     throw error(403, 'Forbidden');
diff --git a/src/routes/api/[recipeLang=recipeLang]/translate/untranslated/+server.ts b/src/routes/api/[recipeLang=recipeLang]/translate/untranslated/+server.ts
index 668b0182..2ad40f23 100644
--- a/src/routes/api/[recipeLang=recipeLang]/translate/untranslated/+server.ts
+++ b/src/routes/api/[recipeLang=recipeLang]/translate/untranslated/+server.ts
@@ -3,7 +3,7 @@ import { Recipe } from '$models/Recipe';
 import { dbConnect } from '$utils/db';
 
 export const GET: RequestHandler = async ({ locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 
 	if (!session?.user?.nickname) {
 		throw error(401, 'Anmeldung erforderlich');
diff --git a/src/routes/api/cospend/balance/+server.ts b/src/routes/api/cospend/balance/+server.ts
index f672cd78..2d1cbbaf 100644
--- a/src/routes/api/cospend/balance/+server.ts
+++ b/src/routes/api/cospend/balance/+server.ts
@@ -5,7 +5,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ locals, url }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/debts/+server.ts b/src/routes/api/cospend/debts/+server.ts
index fc237bf8..f405cf00 100644
--- a/src/routes/api/cospend/debts/+server.ts
+++ b/src/routes/api/cospend/debts/+server.ts
@@ -19,7 +19,7 @@ interface DebtSummary {
 }
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/exchange-rates/+server.ts b/src/routes/api/cospend/exchange-rates/+server.ts
index ececc6cc..ad656952 100644
--- a/src/routes/api/cospend/exchange-rates/+server.ts
+++ b/src/routes/api/cospend/exchange-rates/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ locals, url }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/list/share/+server.ts b/src/routes/api/cospend/list/share/+server.ts
index 30e2a44b..e5502fe3 100644
--- a/src/routes/api/cospend/list/share/+server.ts
+++ b/src/routes/api/cospend/list/share/+server.ts
@@ -6,7 +6,7 @@ import { dbConnect } from '$utils/db';
 
 // GET /api/cospend/list/share — list all active share tokens
 export const GET: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
@@ -25,7 +25,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 
 // POST /api/cospend/list/share — create a new share token
 export const POST: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   const { token, expiresAt } = await createShareToken(auth.user.nickname);
@@ -34,7 +34,7 @@ export const POST: RequestHandler = async ({ locals }) => {
 
 // PATCH /api/cospend/list/share — update a token's expiry
 export const PATCH: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   const { id, expiresAt } = await request.json();
@@ -53,7 +53,7 @@ export const PATCH: RequestHandler = async ({ request, locals }) => {
 
 // DELETE /api/cospend/list/share — revoke a token
 export const DELETE: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   const { id } = await request.json();
diff --git a/src/routes/api/cospend/monthly-expenses/+server.ts b/src/routes/api/cospend/monthly-expenses/+server.ts
index 092dab98..b69f284a 100644
--- a/src/routes/api/cospend/monthly-expenses/+server.ts
+++ b/src/routes/api/cospend/monthly-expenses/+server.ts
@@ -4,7 +4,7 @@ import { Payment } from '$models/Payment';
 import { dbConnect } from '$utils/db';
 
 export const GET: RequestHandler = async ({ url, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
diff --git a/src/routes/api/cospend/payments/+server.ts b/src/routes/api/cospend/payments/+server.ts
index 055019e3..956f25d1 100644
--- a/src/routes/api/cospend/payments/+server.ts
+++ b/src/routes/api/cospend/payments/+server.ts
@@ -13,7 +13,7 @@ interface SplitInput {
 }
 
 export const GET: RequestHandler = async ({ locals, url }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -38,7 +38,7 @@ export const GET: RequestHandler = async ({ locals, url }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/payments/[id]/+server.ts b/src/routes/api/cospend/payments/[id]/+server.ts
index ce4c75f4..9e7143a8 100644
--- a/src/routes/api/cospend/payments/[id]/+server.ts
+++ b/src/routes/api/cospend/payments/[id]/+server.ts
@@ -5,7 +5,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -29,7 +29,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 };
 
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -89,7 +89,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/recurring-payments/+server.ts b/src/routes/api/cospend/recurring-payments/+server.ts
index 45dfdf42..64fe6539 100644
--- a/src/routes/api/cospend/recurring-payments/+server.ts
+++ b/src/routes/api/cospend/recurring-payments/+server.ts
@@ -5,7 +5,7 @@ import { error, json } from '@sveltejs/kit';
 import { calculateNextExecutionDate, validateCronExpression } from '$lib/utils/recurring';
 
 export const GET: RequestHandler = async ({ locals, url }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -38,7 +38,7 @@ export const GET: RequestHandler = async ({ locals, url }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/recurring-payments/[id]/+server.ts b/src/routes/api/cospend/recurring-payments/[id]/+server.ts
index 66f94957..4dac2ab7 100644
--- a/src/routes/api/cospend/recurring-payments/[id]/+server.ts
+++ b/src/routes/api/cospend/recurring-payments/[id]/+server.ts
@@ -6,7 +6,7 @@ import { calculateNextExecutionDate, validateCronExpression } from '$lib/utils/r
 import mongoose from 'mongoose';
 
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -35,7 +35,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 };
 
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -154,7 +154,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/recurring-payments/execute/+server.ts b/src/routes/api/cospend/recurring-payments/execute/+server.ts
index 3e4e2a9e..dfca1bb2 100644
--- a/src/routes/api/cospend/recurring-payments/execute/+server.ts
+++ b/src/routes/api/cospend/recurring-payments/execute/+server.ts
@@ -8,7 +8,7 @@ import { calculateNextExecutionDate } from '$lib/utils/recurring';
 import { convertToCHF } from '$lib/utils/currency';
 
 export const POST: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/recurring-payments/scheduler/+server.ts b/src/routes/api/cospend/recurring-payments/scheduler/+server.ts
index 17601f42..01589432 100644
--- a/src/routes/api/cospend/recurring-payments/scheduler/+server.ts
+++ b/src/routes/api/cospend/recurring-payments/scheduler/+server.ts
@@ -3,7 +3,7 @@ import { error, json } from '@sveltejs/kit';
 import { recurringPaymentScheduler } from '$lib/server/scheduler';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
@@ -22,7 +22,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/cospend/upload/+server.ts b/src/routes/api/cospend/upload/+server.ts
index 9367be51..aafe209c 100644
--- a/src/routes/api/cospend/upload/+server.ts
+++ b/src/routes/api/cospend/upload/+server.ts
@@ -6,7 +6,7 @@ import { randomUUID } from 'crypto';
 import { IMAGE_DIR } from '$env/static/private';
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth || !auth.user?.nickname) {
     throw error(401, 'Not logged in');
   }
diff --git a/src/routes/api/fitness/exercises/+server.ts b/src/routes/api/fitness/exercises/+server.ts
index bcd2b6a1..3a5fe8bf 100644
--- a/src/routes/api/fitness/exercises/+server.ts
+++ b/src/routes/api/fitness/exercises/+server.ts
@@ -5,7 +5,7 @@ import { Exercise } from '$models/Exercise';
 
 // GET /api/fitness/exercises - Search and filter exercises
 export const GET: RequestHandler = async ({ url, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -61,7 +61,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
 // GET /api/fitness/exercises/filters - Get available filter options
 export const POST: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/exercises/[id]/+server.ts b/src/routes/api/fitness/exercises/[id]/+server.ts
index 772902b4..28330985 100644
--- a/src/routes/api/fitness/exercises/[id]/+server.ts
+++ b/src/routes/api/fitness/exercises/[id]/+server.ts
@@ -4,7 +4,7 @@ import { getEnrichedExerciseById, findSimilarExercises } from '$lib/data/exercis
 
 // GET /api/fitness/exercises/[id] - Get enriched exercise with EDB data + similar exercises
 export const GET: RequestHandler = async ({ params, locals, url }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session || !session.user?.nickname) {
 		return json({ error: 'Unauthorized' }, { status: 401 });
 	}
diff --git a/src/routes/api/fitness/exercises/filters/+server.ts b/src/routes/api/fitness/exercises/filters/+server.ts
index e8312024..83934725 100644
--- a/src/routes/api/fitness/exercises/filters/+server.ts
+++ b/src/routes/api/fitness/exercises/filters/+server.ts
@@ -5,7 +5,7 @@ import { Exercise } from '$models/Exercise';
 
 // GET /api/fitness/exercises/filters - Get available filter options
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/intervals/+server.ts b/src/routes/api/fitness/intervals/+server.ts
index 9516cea5..4c18a34c 100644
--- a/src/routes/api/fitness/intervals/+server.ts
+++ b/src/routes/api/fitness/intervals/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { IntervalTemplate, validateIntervalEntries } from '$models/IntervalTemplate';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -20,7 +20,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/intervals/[id]/+server.ts b/src/routes/api/fitness/intervals/[id]/+server.ts
index 5b8d6cc3..b68423a4 100644
--- a/src/routes/api/fitness/intervals/[id]/+server.ts
+++ b/src/routes/api/fitness/intervals/[id]/+server.ts
@@ -5,7 +5,7 @@ import { IntervalTemplate, validateIntervalEntries } from '$models/IntervalTempl
 import mongoose from 'mongoose';
 
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -33,7 +33,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 };
 
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -72,7 +72,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/seed-example/+server.ts b/src/routes/api/fitness/seed-example/+server.ts
index 6c20ccce..cf559c1d 100644
--- a/src/routes/api/fitness/seed-example/+server.ts
+++ b/src/routes/api/fitness/seed-example/+server.ts
@@ -5,7 +5,7 @@ import { WorkoutTemplate } from '$models/WorkoutTemplate';
 
 // POST /api/fitness/seed-example - Create the example workout template
 export const POST: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/sessions/+server.ts b/src/routes/api/fitness/sessions/+server.ts
index debd5ca2..60cf153f 100644
--- a/src/routes/api/fitness/sessions/+server.ts
+++ b/src/routes/api/fitness/sessions/+server.ts
@@ -17,7 +17,7 @@ function estimatedOneRepMax(weight: number, reps: number): number {
 
 // GET /api/fitness/sessions - Get all workout sessions for the user
 export const GET: RequestHandler = async ({ url, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -52,7 +52,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
 // POST /api/fitness/sessions - Create a new workout session
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/sessions/[id]/+server.ts b/src/routes/api/fitness/sessions/[id]/+server.ts
index 275f43b9..afdb597a 100644
--- a/src/routes/api/fitness/sessions/[id]/+server.ts
+++ b/src/routes/api/fitness/sessions/[id]/+server.ts
@@ -7,7 +7,7 @@ import mongoose from 'mongoose';
 
 // GET /api/fitness/sessions/[id] - Get a specific workout session
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -37,7 +37,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 
 // PUT /api/fitness/sessions/[id] - Update a workout session
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -135,7 +135,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 
 // DELETE /api/fitness/sessions/[id] - Delete a workout session
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/sessions/[id]/gpx/+server.ts b/src/routes/api/fitness/sessions/[id]/gpx/+server.ts
index ddfe62c1..ba38affd 100644
--- a/src/routes/api/fitness/sessions/[id]/gpx/+server.ts
+++ b/src/routes/api/fitness/sessions/[id]/gpx/+server.ts
@@ -59,7 +59,7 @@ function parseGpx(xml: string): IGpsPoint[] {
 
 // GET /api/fitness/sessions/[id]/gpx?exerciseIdx=N — download GPX export of the track
 export const GET: RequestHandler = async ({ params, url, locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session || !session.user?.nickname) {
 		return json({ error: 'Unauthorized' }, { status: 401 });
 	}
@@ -115,7 +115,7 @@ export const GET: RequestHandler = async ({ params, url, locals }) => {
 
 // POST /api/fitness/sessions/[id]/gpx — upload GPX file for an exercise
 export const POST: RequestHandler = async ({ params, request, locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session || !session.user?.nickname) {
 		return json({ error: 'Unauthorized' }, { status: 401 });
 	}
@@ -193,7 +193,7 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
 
 // DELETE /api/fitness/sessions/[id]/gpx — remove GPS track from an exercise
 export const DELETE: RequestHandler = async ({ params, request, locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session || !session.user?.nickname) {
 		return json({ error: 'Unauthorized' }, { status: 401 });
 	}
diff --git a/src/routes/api/fitness/sessions/[id]/recalculate/+server.ts b/src/routes/api/fitness/sessions/[id]/recalculate/+server.ts
index 25710a36..3bf2d2fd 100644
--- a/src/routes/api/fitness/sessions/[id]/recalculate/+server.ts
+++ b/src/routes/api/fitness/sessions/[id]/recalculate/+server.ts
@@ -17,7 +17,7 @@ function estimatedOneRepMax(weight: number, reps: number): number {
 
 // POST /api/fitness/sessions/[id]/recalculate — recompute derived fields
 export const POST: RequestHandler = async ({ params, locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session || !session.user?.nickname) {
 		return json({ error: 'Unauthorized' }, { status: 401 });
 	}
diff --git a/src/routes/api/fitness/templates/+server.ts b/src/routes/api/fitness/templates/+server.ts
index 76ee1549..66b333b9 100644
--- a/src/routes/api/fitness/templates/+server.ts
+++ b/src/routes/api/fitness/templates/+server.ts
@@ -5,7 +5,7 @@ import { WorkoutTemplate } from '$models/WorkoutTemplate';
 
 // GET /api/fitness/templates - Get all workout templates for the user
 export const GET: RequestHandler = async ({ url, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -36,7 +36,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
 // POST /api/fitness/templates - Create a new workout template
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/templates/[id]/+server.ts b/src/routes/api/fitness/templates/[id]/+server.ts
index 6ee401f7..2616bac0 100644
--- a/src/routes/api/fitness/templates/[id]/+server.ts
+++ b/src/routes/api/fitness/templates/[id]/+server.ts
@@ -6,7 +6,7 @@ import mongoose from 'mongoose';
 
 // GET /api/fitness/templates/[id] - Get a specific workout template
 export const GET: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -39,7 +39,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 
 // PUT /api/fitness/templates/[id] - Update a workout template
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -103,7 +103,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 
 // DELETE /api/fitness/templates/[id] - Delete a workout template
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session || !session.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/workout/active/+server.ts b/src/routes/api/fitness/workout/active/+server.ts
index 0414d68e..13a6bdf3 100644
--- a/src/routes/api/fitness/workout/active/+server.ts
+++ b/src/routes/api/fitness/workout/active/+server.ts
@@ -6,7 +6,7 @@ import { broadcast } from '$lib/server/sseManager';
 
 // GET /api/fitness/workout/active — fetch current active workout
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session?.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -26,7 +26,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 
 // PUT /api/fitness/workout/active — create or update active workout state
 export const PUT: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session?.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
@@ -92,7 +92,7 @@ export const PUT: RequestHandler = async ({ request, locals }) => {
 
 // DELETE /api/fitness/workout/active — clear active workout (finish/cancel)
 export const DELETE: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session?.user?.nickname) {
     return json({ error: 'Unauthorized' }, { status: 401 });
   }
diff --git a/src/routes/api/fitness/workout/active/stream/+server.ts b/src/routes/api/fitness/workout/active/stream/+server.ts
index 27fcbf77..f43f13c0 100644
--- a/src/routes/api/fitness/workout/active/stream/+server.ts
+++ b/src/routes/api/fitness/workout/active/stream/+server.ts
@@ -3,7 +3,7 @@ import { addConnection, removeConnection } from '$lib/server/sseManager';
 
 // GET /api/fitness/workout/active/stream — SSE endpoint
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session?.user?.nickname) {
     return new Response('Unauthorized', { status: 401 });
   }
diff --git a/src/routes/api/generate-alt-text-bulk/+server.ts b/src/routes/api/generate-alt-text-bulk/+server.ts
index 56676d95..8f3e792c 100644
--- a/src/routes/api/generate-alt-text-bulk/+server.ts
+++ b/src/routes/api/generate-alt-text-bulk/+server.ts
@@ -147,7 +147,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
  */
 export const GET: RequestHandler = async ({ locals }) => {
 	// Check authentication
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session?.user) {
 		throw error(401, 'Unauthorized');
 	}
diff --git a/src/routes/api/glaube/angelus-streak/+server.ts b/src/routes/api/glaube/angelus-streak/+server.ts
index 2fdc540d..2dd78837 100644
--- a/src/routes/api/glaube/angelus-streak/+server.ts
+++ b/src/routes/api/glaube/angelus-streak/+server.ts
@@ -3,7 +3,7 @@ import { AngelusStreak } from '$models/AngelusStreak';
 import { dbConnect } from '$utils/db';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
@@ -29,7 +29,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
diff --git a/src/routes/api/glaube/rosary-streak/+server.ts b/src/routes/api/glaube/rosary-streak/+server.ts
index 1e6ab329..4b7c170b 100644
--- a/src/routes/api/glaube/rosary-streak/+server.ts
+++ b/src/routes/api/glaube/rosary-streak/+server.ts
@@ -3,7 +3,7 @@ import { RosaryStreak } from '$models/RosaryStreak';
 import { dbConnect } from '$utils/db';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
@@ -27,7 +27,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
 
   if (!session?.user?.nickname) {
     throw error(401, 'Authentication required');
diff --git a/src/routes/api/recalculate-image-colors/+server.ts b/src/routes/api/recalculate-image-colors/+server.ts
index 6a32138b..0536b142 100644
--- a/src/routes/api/recalculate-image-colors/+server.ts
+++ b/src/routes/api/recalculate-image-colors/+server.ts
@@ -126,7 +126,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 };
 
 export const GET: RequestHandler = async ({ locals }) => {
-	const session = await locals.auth();
+	const session = locals.session ?? await locals.auth();
 	if (!session?.user) {
 		throw error(401, 'Unauthorized');
 	}
diff --git a/src/routes/api/tasks/+server.ts b/src/routes/api/tasks/+server.ts
index a7d5f9cb..ca7f4b27 100644
--- a/src/routes/api/tasks/+server.ts
+++ b/src/routes/api/tasks/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
@@ -17,7 +17,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const POST: RequestHandler = async ({ request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   const data = await request.json();
diff --git a/src/routes/api/tasks/[id]/+server.ts b/src/routes/api/tasks/[id]/+server.ts
index bd29b039..3f363c95 100644
--- a/src/routes/api/tasks/[id]/+server.ts
+++ b/src/routes/api/tasks/[id]/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const PUT: RequestHandler = async ({ params, request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   const data = await request.json();
@@ -33,7 +33,7 @@ export const PUT: RequestHandler = async ({ params, request, locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
diff --git a/src/routes/api/tasks/[id]/complete/+server.ts b/src/routes/api/tasks/[id]/complete/+server.ts
index 18b70a84..ba442db1 100644
--- a/src/routes/api/tasks/[id]/complete/+server.ts
+++ b/src/routes/api/tasks/[id]/complete/+server.ts
@@ -22,7 +22,7 @@ function getNextDueDate(completedAt: Date, frequencyType: string, customDays?: n
 }
 
 export const POST: RequestHandler = async ({ params, request, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
diff --git a/src/routes/api/tasks/completions/[id]/+server.ts b/src/routes/api/tasks/completions/[id]/+server.ts
index 13e3433b..03cc0440 100644
--- a/src/routes/api/tasks/completions/[id]/+server.ts
+++ b/src/routes/api/tasks/completions/[id]/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const DELETE: RequestHandler = async ({ params, locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
diff --git a/src/routes/api/tasks/stats/+server.ts b/src/routes/api/tasks/stats/+server.ts
index ebd7c2ae..a8083e24 100644
--- a/src/routes/api/tasks/stats/+server.ts
+++ b/src/routes/api/tasks/stats/+server.ts
@@ -4,7 +4,7 @@ import { dbConnect } from '$utils/db';
 import { error, json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
@@ -26,7 +26,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 };
 
 export const DELETE: RequestHandler = async ({ locals }) => {
-  const auth = await locals.auth();
+  const auth = locals.session ?? await locals.auth();
   if (!auth?.user?.nickname) throw error(401, 'Not logged in');
 
   await dbConnect();
diff --git a/src/routes/tasks/+page.server.ts b/src/routes/tasks/+page.server.ts
index ebe23c26..4fff498f 100644
--- a/src/routes/tasks/+page.server.ts
+++ b/src/routes/tasks/+page.server.ts
@@ -2,7 +2,7 @@ import type { PageServerLoad } from './$types';
 import { redirect } from '@sveltejs/kit';
 
 export const load: PageServerLoad = async ({ locals, fetch }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session) throw redirect(302, '/login');
 
   const [tasksRes, statsRes] = await Promise.all([
diff --git a/src/routes/tasks/rewards/+page.server.ts b/src/routes/tasks/rewards/+page.server.ts
index a90d5cb0..ff111de7 100644
--- a/src/routes/tasks/rewards/+page.server.ts
+++ b/src/routes/tasks/rewards/+page.server.ts
@@ -2,7 +2,7 @@ import type { PageServerLoad } from './$types';
 import { redirect } from '@sveltejs/kit';
 
 export const load: PageServerLoad = async ({ locals, fetch }) => {
-  const session = await locals.auth();
+  const session = locals.session ?? await locals.auth();
   if (!session) throw redirect(302, '/login');
 
   const statsRes = await fetch('/api/tasks/stats');