Adding to the last message…. In fact on a mobile, the error happens using safari and chrome! it retains the url of
domain.com/login-page/?redirect_to=https%3A%2F%2Fwww.domain.com%2F
and does not show the page unprotected.
If you login via web browser on a desktop the url changes to domain.com and you can see the content.