Turn on Anonymous access

Can you try to add the xpack.security.sameSiteCookies and xpack.security.secureCookies options as per this thread? Let us know if this resolves your loop issue.