Expired sign-in and message forms now recover gracefully

Improvement

Week of June 14, 2026

Occasionally a form would sit open long enough that the browser’s security check expired before it was submitted — most often when entering a sign-in code, or when a page was reopened from a link in a text message or email. When that happened, advocates could be quietly redirected to the home page with no explanation.

A clear message instead of a silent redirect — an expired submission now shows “For your security, this page expired before it could be submitted. Please try again.”
You keep your place — you’re returned to the form you were on, refreshed and ready to resubmit, rather than dumped on the home page and forced to start over.
Messages aren’t dropped — sending a message to an advocate continues to work even if the page had been open a while, while genuinely suspicious cross-site submissions are still blocked.

No admin action required.