{% comment %} Base template for the emailed-token confirmation landings (#3257). Deliberately standalone — it does NOT extend auth_base.html. Those four pages carry a CSP nonce and hold tokens in localStorage; a landing does neither, and inheriting their nonce contract would silently disable this page's script on any deployment that turns the CSP on. Rules this file exists to keep: * The token appears ONCE, inside the `json_script` data block. Django renders that as `type="application/json"`, which HTML treats as a data block — never executed, read back with `.textContent`. It is never interpolated into the