Signed out, the account hub asks no API on its way to /login (history, themes and notifications logged 401s) (#316)

ddiff --git a/public/js/my/boot.js b/public/js/my/boot.js
iindex 319abcbb..0423cce0 100644
---- a/public/js/my/boot.js
++++ b/public/js/my/boot.js
@@@ -4,9 +4,13 @@
     my/core.js's helpers (apiFetch, getAuthToken, showSection, API) and on
     my/boot.js (loaded last), which starts the page. No ES modules.
     ═══════════════════════════════════════════════════════════════ */
--// Init
++// Init. Signed out, loadUser() sends the visitor to /login: the section and the badge stay unasked, so the page never
++// calls an API that answers 401 on the way there (/history, /themes and /notifications logged two each).
  OpenVibeAccountSwitcher.init({ apiBase: API });
++const _signedIn = !!(getAuthToken() || getAnonToken());
  loadUser();
  buildDashboardShowcase();
--openInitialSection();
--refreshApprovalsBadge();
++if (_signedIn) {
++    openInitialSection();
++    refreshApprovalsBadge();
++}
ddiff --git a/test/my-modules.test.js b/test/my-modules.test.js
iindex e2c128ce..2181d3a9 100644
---- a/test/my-modules.test.js
++++ b/test/my-modules.test.js
@@@ -38,7 +38,10 @@ assert.ok(html.includes('id="sec-approvals"') && html.includes('id="approvals-li
  const approvals = fs.readFileSync(path.join(pub, 'js', 'my', 'approvals.js'), 'utf8');
  assert.ok(!/innerHTML|insertAdjacentHTML/.test(approvals), 'approvals.js never parses agent text as HTML');
  for (const name of ['loadApprovals', 'decideApproval', 'refreshApprovalsBadge']) assert.strictEqual(owner.get(name), 'approvals.js', `${name} lives in approvals.js`);
--assert.ok(fs.readFileSync(path.join(pub, 'js', 'my', 'boot.js'), 'utf8').includes('refreshApprovalsBadge()'), 'boot.js shows the waiting count on the tab');
++const bootSrc = fs.readFileSync(path.join(pub, 'js', 'my', 'boot.js'), 'utf8');
++assert.ok(bootSrc.includes('refreshApprovalsBadge()'), 'boot.js shows the waiting count on the tab');
++// Signed out (loadUser() redirects to /login), no section loads and no badge is asked for: each would answer 401.
++assert.match(bootSrc, /if \(_signedIn\) \{\s*openInitialSection\(\);\s*refreshApprovalsBadge\(\);\s*\}/, 'signed out, boot.js asks no API');
  // The host is a SubjectRef object: the row names its id, never "[object Object]"; an anonymous session calls no API.
  {
      const vm = require('vm');