The login and identity pages take their language only from the origamCurrentLocale cookie; otherwise LanguageConfig.Default applies. A client that cannot set that cookie — a bundled frontend on another origin, an embedded browser — shows the default language until the user switches it by hand, although the browser sends Accept-Language.
Proposal: an opt-in key under LanguageConfig, off by default.
- Cookie first, then
Accept-Languagewith parent-culture fallback (en-US→en), then the default culture. - The cultures offered on the login page stay separate from the ones used for matching, so a fallback culture does not add a duplicate link.
- Server-side localization in
/api/privateuses the same resolution instead of reading the cookie provider directly. - Template entry, the appsettings.json documentation article, and tests for the header and for the flag being off.
I can prepare the pull request; the result will be linked here.