[rjcloudsigma]

Summary

Accept the documented successful login response: HTTP 200 with an exactly empty body. Only _login_session skips JSON decoding for that exact case. Other statuses, nonempty responses, ordinary API decoding, cookie/CSRF checks, session ownership and MFA protections remain unchanged.

Verification

• Independent review: SAFE_FOR_PUBLICATION for exact three-file patch SHA256 e8b5c359efbc9f9481a1997d724227d79de25feb2ab60d45a1e08f168516f54a.
• Base e653ee7e8c233a697903aed2f114a753574c1b98; reviewed tree 4ffe5d9af597825270859c36db47ebb54f415ef4.
• Actual installed-wheel regression: baseline 8 tests / 3 errors; candidate 8 PASS. Existing baseline 247 PASS; complete candidate 255 PASS on Python 3.12.
• New native Requests adapter tests exercise cookie extraction, follow-up headers, constructor and borrowed sessions, missing CSRF cookie, errors/redirects, malformed bodies, ordinary JSON decoding and other success statuses.
• CI finite count 247 → 255 matches independently discovered tests. Hosted installed-wheel Python 3.10–3.12 checks required before merge.

No live authentication, account/configuration/credential changes, OTP enrollment, releases or deployments. Synthetic transport does not qualify live server MFA/session behavior.