what it looks like is happening is that kratos when queried from oathkeeper returns a redirect for unauthorized (401), but when queried from the node ui, it returns a valid user (recognizes a logged in user). this is validated by the redirect loop (redirects to login, login is already valid, so it redirects back to the

return_to

) and by me accessing

/auth

directly and getting the logged in user dashboard.