Gotcha. Well good 
I’m glad the 301-home and token refresh on page load is working. I think that’s probably the best bet for static-file sites (as opposed to Hybrid react / SPA / PWA sites) using role-gated _redirects for access control 
What a journey.