User not logged in, even after `LoginSuccessEvent` fired - authentication

Question

It worked a while back, but I'm having issues backtracking where I went wrong.
I'll give you all the details first:
#security.yaml
security:
password_hashers:
Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
providers:
users:
entity:
class: 'App\Entity\User'
property: 'username'
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
lazy: true
provider: users
form_login:
login_path: app_login
check_path: app_login
enable_csrf: true
logout:
path: app_logout
access_control:
- { path: ^/admin, roles: ROLE_ADMIN }
- { path: ^/profile, roles: ROLE_USER }
role_hierarchy:
ROLE_ADMIN: ROLE_USER
ROLE_SUPER_ADMIN: [ ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH ]
Pretty basic, here's where it gets messy for me:
controllers:
resource: ../src/Controller/
type: annotation
prefix: /{_locale}
requirements:
_locale: '%app.supported_locales%'
defaults:
_locales: '%app.default_locale%'
middleware: 'locale_middleware'
app_default_locale_redirect:
path: /
methods: GET
controller: App\Controller\DefaultController::defaultLocaleRedirect
defaults:
_locale: '%app.default_locale%'
requirements:
_locale: '^(?!%app.supported_locales%).*'
app_login:
path: /{_locale}/login
app_logout:
path: /{_locale}/logout
methods: GET
I want to redirect all URLs that don't have a supported locale in the URL to the default locale. That's what the middleware is for, and thats why app_login and app_logout both have /{_locale} in their paths. It works as far as I can see.
My default controller handles that using method:
/**
* #Route("/default-locale-redirect")
*/
public function defaultLocaleRedirect(Request $request): RedirectResponse
{
$defaultLocale = $request->getLocale();
return new RedirectResponse($request->getBaseUrl() . '/' . $defaultLocale . '/');
}
I'm also subscribed to the LoginSuccessEvent event, and relevant events:
public static function getSubscribedEvents(): array {
return [
LogoutEvent::class => 'onLogout',
LoginSuccessEvent::class => "onLogin",
LoginFailureEvent::class => "onLoginFailure"
];
}
public function onLogout(LogoutEvent $event): void {
$this->flash->add("success", $this->trans->trans("account.auth.logged_off"));
}
public function onLogin(LoginSuccessEvent $event): void {
$token = $this->tokenStorage->getToken();
$user = $token->getUser();
$roles = $token->getRoleNames();
$this->flash->add("success", $this->trans->trans("account.auth.logged_on"));
}
public function onLoginFailure(LoginFailureEvent $event): void {
$this->flash->add("error", $this->trans->trans("account.auth.failed"));
}
When I place a breakpoint in onLogin, the breakpoint gets hit, and $token, $user and $roles are populated perfectly.
After the page reloads, though, I notice the user is not authenticated. Somehow I believe the token is not persisted. The dev toolbar confirms this, and is_granted("IS_AUTHENTICATED_FULLY") also returns false.
I tried clearing all caches. What am I doing wrong?