I suppose this is the point where it's finally paid off to have a Content-Security-Policy in place. Mastodon should really ship one by default 😐
Why is this step necessary? mastodon.at might not be the server where you are registered, so we need to redirect you to your home server first. Don't have an account? You can sign up here
mastodon.at