Hi Alec,
Thanks for checking up on this, it's got me quite puzzled! I appreciate your time.
I can't speak for Ribas' screenshot skin, but the behavior he shows matches my experience. I'm normally running managesieve and password as plugins, but this behavior is consistent with or without any plugins enabled (I've tried both to rule them out).
I have no errors in the browser console when this occurs and only one warning: "The character encoding of a framed document was not declared. The document may appear different if viewed without the document framing it."
For full context, here are the logs from nginx once I click the "Allow" button:
<Source IP> - - [26/Jun/2021:14:46:58 -0400] "GET /?_task=mail&_framed=1&_caps=&_uid=15636&_mbox=INBOX&_safe=1&_action=preview HTTP/1.1" 200 78 "https://<hostname>/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
<Source IP> - - [26/Jun/2021:14:46:58 -0400] "GET /mail/ HTTP/1.1" 200 10110 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
<Source IP> - - [26/Jun/2021:14:46:58 -0400] "GET /mail/program/js/list.min.js?s=1614281846 HTTP/1.1" 200 28708 "https://<hostname>/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
<Source IP> - - [26/Jun/2021:14:46:59 -0400] "GET /mail/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1624733218861 HTTP/1.1" 200 111 "https://<hostname>/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
<Source IP> - - [26/Jun/2021:14:46:59 -0400] "GET /mail/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_remote=1&_unlock=loading1624733218985&_=1624733218860 HTTP/1.1" 200 3053 "https://<hostname>/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"
<Source IP> - - [26/Jun/2021:14:47:59 -0400] "POST /mail/?_task=mail&_action=refresh HTTP/1.1" 200 162 "https://<hostname>/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0"