maybe I’ve just found the error. the redirect snippet needs to point to the login page, not home.
<?php if(!$site->user()) go('/login') ?>
instead of
<?php if(!$site->user()) go('/') ?>
which makes sense in a way. Otherwise the controller and the snippet are endlessly redirecting to each other which is detected and interrupted by the browser.