AI and CLI Authorization Forms Restored
Fixes browser Allow submissions that no-referrer turned into Origin:null; authorization and token-management forms work again while exact-origin, session, and CSRF checks remain unchanged.
# AI and CLI Authorization Forms Restored
Browser device authorization works again. Previously, the authorization HTML inherited a `no-referrer` policy that caused the Allow form POST to carry `Origin: null`, so the server's exact same-origin check correctly rejected it.
## What changed
- Only the device-authorization and token-management HTML pages now use `strict-origin`, preserving the exact site origin required by their form submissions.
- The browser sends only an origin such as `https://lusu575.com`; it does not expose the path or query string containing `user_code`.
- JSON endpoints remain on `no-referrer`, so their privacy policy has not been relaxed.
- The revoke forms under `/tokens/manage` receive the same fix.
## Security boundary unchanged
POST requests must still pass exact `Origin`, signed-in session, and CSRF checks. Missing origins, `Origin: null`, any origin different from the authorization page, and attacker origins remain rejected. Top-level authorization GET navigations opened from a CLI, Codex, or another external link are now accepted, while iframe and other subresource loads remain blocked.
Quick Transfer is now version 1.0.5 with no change to its transfer protocol. The separate remote MCP Worker remains undeployed.
