Q010

A mutation request without the CSRF proof (POST, JSON, x-kerf: 1, same origin): 403.

Fix: Call mutations through their stub, not a hand-made fetch or form.

Status in kerf@0.1.0: reported by @kerf-js/start when it serves or renders the route, and by kerf check and kerf routes --meta.