{% comment %}
Hand-off page ending a mobile login on the app deep link — served instead of
a plain 302 to the custom scheme, which the IdP login page's CSP form-action
blocks at the end of the credential form's redirect chain (see
mobile_login_handoff in core/authentication/views.py for the full rationale).
The script keeps the silent path (iOS interception); the link is the Android
fallback — a user-activated navigation from this page, outside the IdP CSP.
{% endcomment %}
Messages