The "refresh patched" update wasn't just a simple bug fix; it was an architectural shift. Here is why it mattered: Breaking the "External" Meta
The server now checks for a valid CSRF token upon every frame refresh. viewerframe mode refresh patched