F002

A form POST without the same-origin proof (Origin, or Sec-Fetch-Site: same-origin): 403.

Fix: Submit through a <Form> on the same origin; behind a proxy, forward the host so the origins match.

Status in weft@0.1.0: reported by @weft-js/start when it serves or renders the route, and by weft check and weft routes --meta.