- Add _validating flag to prevent recursive hashchange calls during async token validation - route() checks _validating before calling validateAuth(), sets flag before async call, clears in .then/.catch handlers - route() returns early if still validating (waits for completion) - Fixes: expired token causing infinite login redirect loop