When the SPA authenticates via cookies (not Bearer token), Sanctum returns a TransientToken from currentAccessToken() which has no delete() method. Detect it and invalidate the session instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>