F002

A form POST without the same-origin proof (Origin, or Sec-Fetch-Site: same-origin): 403.

Fix: Submit through a <Form> on the same origin; behind a proxy, forward the host so the origins match.

Status in kerf@0.1.0: reported by @kerf-js/start when it serves or renders the route, and by kerf check and kerf routes --meta.