I think your nginx is returning a cached page even though the user is logged in, because nginx caching doesn't factor in request cookies - https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_key

Default: 	proxy_cache_key $scheme$proxy_host$request_uri;

Once a user does a privileged action now flask sends the first set-cookie header which starts bypassing the nginx cache (flask then does it on every subsequent req too). My varnish is set to not cache if there's request cookies, so that's why I haven't run into this.

I think this should fix - https://codeberg.org/rimu/pyfedi/pulls/1785