verifyFightIdentity fetched /handle/<sub>, but that route is a path the piece-page handler swallows: it returns 404 HTML, so !response.ok sent every caller home with 'Your AC session could not be verified.' The endpoint takes ?for= instead. Public fight auth has been shut since it landed, and because chat.mjs opens a fight socket for anyone holding a token, laklok was showing the error to people who never asked to fight.