Auth dialog can show authenticated state without login cookies

Version

prime branch / latest

Platform

Windows

Steps to reproduce

• Open the authentication dialog
• Let the embedded browser get normal YouTube cookies, but not actual signed-in cookies
  • for example, just visiting YouTube can leave some cookies behind even if the user is not logged in

Details

I noticed the auth check can treat "has some YouTube cookies" as "signed in".

The current check looks like this:

public bool IsAuthenticated =>
    Cookies?.Any() == true
    && Cookies
        .Where(c => c.Name.StartsWith("__SECURE", StringComparison.OrdinalIgnoreCase))
        .All(c => !c.Expired && c.Expires.ToUniversalTime() > DateTime.UtcNow);

The problem is that All(...) returns true for an empty list. So if the browser has regular YouTube cookies, but no __SECURE login cookies, IsAuthenticated can still become true.

That means the dialog may hide the login browser and show the authenticated state even though the user is not actually signed in.

I think the check needs to require at least one relevant login cookie before it accepts the session as authenticated.