We’ve tracked it down to an environment issue. The problem occurs when an X-Content-Type-Options: nosniff header is sent with a 204 response. Ghost does not add that header which is why the impact has been limited to self-hosters with a hosting setup that does add that header to the auth-frame endpoint.
We’re looking at ways to avoid the problem but in the meantime I’d suggest configuring your hosting setup so it doesn’t add that header, either generally or more specifically on 204s or even just that endpoint - all will be sufficient to fix the problem.
Just like to chime in here and say I’m also running into this issue on the latest iOS. I appreciate that the staff tracked down it down to an environment issue but I have absolutely no idea where to start with configuring the 204s on a DigitalOcean server and hope the issue can be resolved soon!