Eric WagonerandClaude Fable 5
344a930a8a
The phone's first visit 403'd its own subresources: Safari's preload scanner fetches /static/* before the document response's Set-Cookie is committed, and favicon/apple-touch-icon probes are cookie-less system fetches. A ?k= visit now answers 303-with-cookie to the same path — the cookie is committed before any document loads, and the key is scrubbed from the phone's address bar and history. /static/* and the icon probe paths are exempt from the key: they're the app's own css/js/artwork, no user data (shelf photos stay gated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g