So, reinstalling Firefly-III and setting “Should this app be exposed to anonymous visitors?” to true “solves” the problem.
I am really unhappy with this, since I don’t want to expose an app containing my financial information to anonymous visitors. The question remains: Is there some way to make certain URLs exempt from the login redirection?