Account persistence via refreshless JWT renewal

Authentication bypass in Rodauth before 2.47.0 allows remote authenticated users to renew JWT access tokens without refresh tokens. On non-POST requests, set_jwt_token leaves a newly signed token in the Authorization response header even when the refresh route returns 405 or 406 without validating a refresh token. The jwt_refresh feature must be enabled; a valid access token is sufficient by default, while expired-token abuse also requires allow_refresh_with_expired_jwt_access_token? true, and access persists until an account token-clearing event.