translations fixed to be safe

web/src/services/mod.rs

@@ -25,10 +25,15 @@ pub(crate) fn authenticated_request<T>(
 
 /// Refuses a form POST that another site made the browser send.
 ///
-/// The session cookie is `SameSite=Strict`, so a cross-site post arrives
-/// without it and fails on authentication anyway; this turns that into a plain
-/// refusal instead of a redirect to the login page, and covers every
-/// state-changing endpoint the same way.
+/// For an authenticated endpoint the session cookie is `SameSite=Strict`, so a
+/// cross-site post arrives without it and fails on authentication anyway; this
+/// turns that into a plain refusal instead of a redirect to the login page.
+/// `POST /login` needs the check on its own account: it takes no session but
+/// hands one out, and Strict governs sending a cookie, not setting one.
+///
+/// Call this *first* in a handler, before any backend request. It is a refusal,
+/// not a filter — work done ahead of it is work a forged post can make the
+/// server do.
 pub(crate) fn reject_cross_site(headers: &HeaderMap) -> Option<Response> {
     headers
         .get("sec-fetch-site")