diff --git a/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md b/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
index 349e0ff..507a7e5 100644
--- a/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
+++ b/docs/superpowers/plans/2026-08-12-api-tokens-openapi.md
@@ -822,6 +822,12 @@ func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sess, ok := sessionFromCookie(c)
 		if !ok {
+			// A cookie that was presented and rejected has already been
+			// answered. Falling through would put a second JSON body on the
+			// wire for the ordinary expired-session case.
+			if c.IsAborted() {
+				return
+			}
 			sess, ok = sessionFromToken(c)
 		}
 		if !ok {