The access token header has been changed from Base64 to lowercase hexadecimal. New access tokens now contain only hexadecimal characters [0-9a-f], eliminating special characters such as =, +, and / when tokens are transmitted through cookies, HTTP headers, query parameters, or intermediate parsers. The token length has also increased from 108 to 128 characters.

AccessTokens.extractBearerToken now extracts a token only when the input starts with the standard Bearer prefix. The previous indexOf("Bearer ") approach has been removed to prevent incorrectly parsing malformed Authorization header values.

Introduced the Hexes utility with Hexes.toLowercaseHex(byte[]) and Hexes.decodeLowercaseHex(String). The decoder validates both hexadecimal length and character validity, allowing invalid input to be detected early instead of producing unexpected results.

AdminViews.redirectToLogin and WebViews.redirectToLogin are now responsible only for redirect and login callback handling. Access token cleanup has been moved to dedicated HTTP response utilities, providing clearer separation of responsibilities and making the cleanup logic reusable across different authentication flows.

Added HttpResponses.clearAdminAccessToken(HttpServletResponse) to remove adminAccessToken and adminAccessTokenExpiredAt, and HttpResponses.clearUserAccessToken(HttpServletResponse) to remove accessToken and accessTokenExpiredAt. Cleared cookies are configured with path /, max age 0, and the HttpOnly attribute.

AdminGlobalExceptionHandler now automatically clears the admin access token when an invalid token, an expired token, or an HttpUnauthorizedException is encountered. This ensures stale authentication cookies are removed before redirecting users back to the login page or continuing error processing.

WebGlobalExceptionHandler now clears the admin token whenever an admin token is invalid or expired, and clears the user token whenever a user token is invalid or expired. For HttpUnauthorizedException, both user and admin authentication cookies are cleared before redirecting to the login page or returning an HTTP 401 Unauthorized API response.

Existing Base64-formatted access tokens are no longer valid after upgrading to this release. Administrators and users currently signed in with older tokens may need to sign in again to receive new lowercase hexadecimal access tokens.