GET /auth/me signed out answers 200 { user: null } like Blog, Community and Wiki (a 401 showed in every signed-out visitor's console) (#86)

ddiff --git a/server/auth/sso.js b/server/auth/sso.js
iindex 3860bde..96994ff 100644
---- a/server/auth/sso.js
++++ b/server/auth/sso.js
@@@ -100,7 +100,7 @@ function createSsoRoutes({ config, auth, fetchImpl = globalThis.fetch }) {
      router.get('/me', async (req, res) => {
          const token = (req.cookies && req.cookies[ACCESS]) || null;
          const claims = token ? await auth.verifyUser(token) : null;
--        if (!claims) return res.status(401).json({ error: 'Not authenticated' });
++        if (!claims) return res.json({ user: null });   // signed out: 200 with no user (as Blog, Community, Wiki), not a 401 in every signed-out visitor's console
          const { iat, exp, aud, iss, nbf, jti, ...user } = claims;
          return res.json({ user, expires_at: exp ? exp * 1000 : null });
      });
ddiff --git a/test/api.test.js b/test/api.test.js
iindex 4a3e6f9..ea37921 100644
---- a/test/api.test.js
++++ b/test/api.test.js
@@@ -81,7 +81,7 @@ t('a typed Network token (a realtime ticket, a FedCM assertion) is never a sessi
          assert.strictEqual(bearer.status, 401, JSON.stringify(bearer.body));
          assert.strictEqual(bearer.body.code, 'token.invalid');
          const me = await request(api.base, 'GET', '/auth/me', { cookie: `ov_token=${token}` });
--        assert.strictEqual(me.status, 401, 'not signed in with it');
++        assert.deepStrictEqual([me.status, me.body.user], [200, null], 'not signed in with it (signed out answers 200 with no user)');
      }
      const session = await request(api.base, 'GET', '/auth/me', { cookie: `ov_token=${owner}` });
      assert.strictEqual(session.status, 200, 'the session token itself still signs in');