Function require_operator 

pub async fn require_operator(
    __arg0: State<Arc<Operator>>,
    req: Request,
    next: Next,
) -> Response

Axum middleware: the request must carry a live session cookie (401 unauthenticated otherwise). The session goes into the request’s extensions as Authenticated; when this request slid its expiry, the cookie is sent again so the browser’s copy lives as long. Not when the handler set a cookie of its own, nor once the session has ended (a request that revokes its own session): the browser keeps the last Set-Cookie, and that must not be the dead token.