Page origin: . Use a fresh private window per run (or the clear button) so a token from an earlier test doesn't mask a failure. Tokens are immune for 300s.