diff --git a/server/internal/auth/middleware.go b/server/internal/auth/middleware.go
index d50836f..e17acc3 100644
--- a/server/internal/auth/middleware.go
+++ b/server/internal/auth/middleware.go
@@ -61,6 +61,13 @@ func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sess, ok := sessionFromCookie(c)
 		if !ok {
+			// A cookie that was presented and rejected has already had its
+			// response written by sessionFromCookie (no bearer was present to
+			// fall through to). Trying sessionFromToken anyway would write a
+			// second body onto the same response.
+			if c.IsAborted() {
+				return
+			}
 			sess, ok = sessionFromToken(c)
 		}
 		if !ok {