Behind Cloudflare Access or a similar proxy, an expired proxy session answers every API call with a redirect to the proxy's login on another origin. A fetch can't follow that, so it failed as a network error, and an installed app never got out of it: it opens on an app route the service worker serves from its kept copy, so nothing navigated to the network for the proxy to catch (#47). When an API call fails at the network, or comes back redirected to a page that isn't ours, the app now asks /api/health without following redirects. A redirect or an HTML answer means the proxy is asking, and the root is opened for real, which the service worker always sends to the network. At most once a minute, so a misconfigured proxy can't loop. Fixes #47