More work on authentication for staff and against the Novi UUIDs.

src/routes/idaa/(idaa)/+layout.svelte

@@ -32,6 +32,7 @@ if (browser) {
 
     // Reminder: super > manager > administrator > trusted > public > authenticated > anonymous
 
+    // NOTE: This is checking if they are in an iframe *and* have a Novi UUID. We ignore the iframe mode for trusted and above (administrators, managers, etc).
     if ($ae_loc.iframe && $idaa_loc?.novi_uuid?.length == 36 && $idaa_loc?.novi_email?.length > 3 && $idaa_loc?.novi_full_name?.length > 0) {
         $ae_loc.access_type = 'authenticated';
         $ae_loc.authenticated_access = true;