diff --git a/docs/api.md b/docs/api.md
index 2ff8f077d..82244936f 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -8,20 +8,22 @@ most of the available filters and ordering fields.
 
 The API provides the following main endpoints:
 
+- `/api/consumption_templates/`: Full CRUD support.
+- `/api/correspondents/`: Full CRUD support.
+- `/api/custom_fields/`: Full CRUD support.
 - `/api/documents/`: Full CRUD support, except POSTing new documents.
   See below.
-- `/api/correspondents/`: Full CRUD support.
 - `/api/document_types/`: Full CRUD support.
+- `/api/groups/`: Full CRUD support.
 - `/api/logs/`: Read-Only.
-- `/api/tags/`: Full CRUD support.
-- `/api/tasks/`: Read-only.
 - `/api/mail_accounts/`: Full CRUD support.
 - `/api/mail_rules/`: Full CRUD support.
-- `/api/users/`: Full CRUD support.
-- `/api/groups/`: Full CRUD support.
-- `/api/share_links/`: Full CRUD support.
-- `/api/custom_fields/`: Full CRUD support.
 - `/api/profile/`: GET, PATCH
+- `/api/share_links/`: Full CRUD support.
+- `/api/storage_paths/`: Full CRUD support.
+- `/api/tags/`: Full CRUD support.
+- `/api/tasks/`: Read-only.
+- `/api/users/`: Full CRUD support.
 
 All of these endpoints except for the logging endpoint allow you to
 fetch (and edit and delete where appropriate) individual objects by
diff --git a/src-ui/src/app/components/admin/logs/logs.component.ts b/src-ui/src/app/components/admin/logs/logs.component.ts
index 2ca259218..0c1231a48 100644
--- a/src-ui/src/app/components/admin/logs/logs.component.ts
+++ b/src-ui/src/app/components/admin/logs/logs.component.ts
@@ -54,6 +54,7 @@ export class LogsComponent implements OnInit, AfterViewChecked, OnDestroy {
   ngOnDestroy(): void {
     this.unsubscribeNotifier.next(true)
     this.unsubscribeNotifier.complete()
+    clearInterval(this.autoRefreshInterval)
   }
 
   reloadLogs() {
diff --git a/src-ui/src/app/components/admin/tasks/tasks.component.ts b/src-ui/src/app/components/admin/tasks/tasks.component.ts
index 5a1949e77..b6b5ec590 100644
--- a/src-ui/src/app/components/admin/tasks/tasks.component.ts
+++ b/src-ui/src/app/components/admin/tasks/tasks.component.ts
@@ -46,6 +46,7 @@ export class TasksComponent
 
   ngOnDestroy() {
     this.tasksService.cancelPending()
+    clearInterval(this.autoRefreshInterval)
   }
 
   dismissTask(task: PaperlessTask) {
diff --git a/src-ui/src/app/components/common/input/select/select.component.html b/src-ui/src/app/components/common/input/select/select.component.html
index bdffbcc12..3a10b0019 100644
--- a/src-ui/src/app/components/common/input/select/select.component.html
+++ b/src-ui/src/app/components/common/input/select/select.component.html
@@ -34,6 +34,9 @@
             (focus)="clearLastSearchTerm()"
             (clear)="clearLastSearchTerm()"
             (blur)="onBlur()">
+            <ng-template ng-option-tmp let-item="item">
+                <span [title]="item.name">{{item.name}}</span>
+            </ng-template>
           </ng-select>
           @if (allowCreateNew) {
             <button class="btn btn-outline-secondary" type="button" (click)="addItem()" [disabled]="disabled">
diff --git a/src/documents/barcodes.py b/src/documents/barcodes.py
index 3e2b309b6..005531107 100644
--- a/src/documents/barcodes.py
+++ b/src/documents/barcodes.py
@@ -105,7 +105,7 @@ class BarcodeReader:
             asn_text = asn_text[len(settings.CONSUMER_ASN_BARCODE_PREFIX) :].strip()
 
             # remove non-numeric parts of the remaining string
-            asn_text = re.sub("[^0-9]", "", asn_text)
+            asn_text = re.sub(r"\D", "", asn_text)
 
             # now, try parsing the ASN number
             try:
diff --git a/src/paperless/auth.py b/src/paperless/auth.py
index 2285d0526..a23b01cb4 100644
--- a/src/paperless/auth.py
+++ b/src/paperless/auth.py
@@ -2,12 +2,16 @@ from django.conf import settings
 from django.contrib import auth
 from django.contrib.auth.middleware import PersistentRemoteUserMiddleware
 from django.contrib.auth.models import User
+from django.http import HttpRequest
 from django.utils.deprecation import MiddlewareMixin
 from rest_framework import authentication
 
 
 class AutoLoginMiddleware(MiddlewareMixin):
-    def process_request(self, request):
+    def process_request(self, request: HttpRequest):
+        # Dont use auto-login with token request
+        if request.path.startswith("/api/token/") and request.method == "POST":
+            return None
         try:
             request.user = User.objects.get(username=settings.AUTO_LOGIN_USERNAME)
             auth.login(
diff --git a/src/paperless/settings.py b/src/paperless/settings.py
index 0c4831932..ae021f6b1 100644
--- a/src/paperless/settings.py
+++ b/src/paperless/settings.py
@@ -315,8 +315,8 @@ if DEBUG:
 REST_FRAMEWORK = {
     "DEFAULT_AUTHENTICATION_CLASSES": [
         "rest_framework.authentication.BasicAuthentication",
-        "rest_framework.authentication.SessionAuthentication",
         "rest_framework.authentication.TokenAuthentication",
+        "rest_framework.authentication.SessionAuthentication",
     ],
     "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.AcceptHeaderVersioning",
     "DEFAULT_VERSION": "1",
diff --git a/src/paperless/urls.py b/src/paperless/urls.py
index 79602db00..1c0dafd65 100644
--- a/src/paperless/urls.py
+++ b/src/paperless/urls.py
@@ -6,6 +6,7 @@ from django.urls import path
 from django.urls import re_path
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.csrf import ensure_csrf_cookie
 from django.views.generic import RedirectView
 from rest_framework.authtoken import views
 from rest_framework.routers import DefaultRouter
@@ -180,7 +181,11 @@ urlpatterns = [
     # login, logout
     path("accounts/", include("django.contrib.auth.urls")),
     # Root of the Frontend
-    re_path(r".*", login_required(IndexView.as_view()), name="base"),
+    re_path(
+        r".*",
+        login_required(ensure_csrf_cookie(IndexView.as_view())),
+        name="base",
+    ),
 ]
 
 
diff --git a/src/paperless_mail/mail.py b/src/paperless_mail/mail.py
index 906aafa15..0a237439c 100644
--- a/src/paperless_mail/mail.py
+++ b/src/paperless_mail/mail.py
@@ -703,6 +703,12 @@ class MailAccountHandler(LoggingMixin):
             mime_type = magic.from_buffer(att.payload, mime=True)
 
             if is_mime_type_supported(mime_type):
+                self.log.info(
+                    f"Rule {rule}: "
+                    f"Consuming attachment {att.filename} from mail "
+                    f"{message.subject} from {message.from_}",
+                )
+
                 os.makedirs(settings.SCRATCH_DIR, exist_ok=True)
 
                 temp_dir = Path(
@@ -711,14 +717,15 @@ class MailAccountHandler(LoggingMixin):
                         dir=settings.SCRATCH_DIR,
                     ),
                 )
-                temp_filename = temp_dir / pathvalidate.sanitize_filename(att.filename)
-                temp_filename.write_bytes(att.payload)
 
-                self.log.info(
-                    f"Rule {rule}: "
-                    f"Consuming attachment {att.filename} from mail "
-                    f"{message.subject} from {message.from_}",
-                )
+                attachment_name = pathvalidate.sanitize_filename(att.filename)
+                if attachment_name:
+                    temp_filename = temp_dir / attachment_name
+                else:  # pragma: no cover
+                    # Some cases may have no name (generally inline)
+                    temp_filename = temp_dir / "no-name-attachment"
+
+                temp_filename.write_bytes(att.payload)
 
                 input_doc = ConsumableDocument(
                     source=DocumentSource.MailFetch,