- Shipped
- August 20, 2026 at 1:25 AM UTC
- Author
- Kamo
- Commit
- f10271e
The marketing site tags a referred visitor with kmrt_vid and kmrt_src on the shared apex, so register.<apex> can read them; handleFinish sends both in the request body, falling back to ?mrt= for the code when the visitor arrives with the link still in the address bar. Body, not headers: the /api proxy strips Cookie and the ingress rewrites X-Forwarded-Host, which is also why the cookies are not httpOnly. Absent values are omitted rather than sent as empty strings, since most signups have neither. The cookie reader the logout page had inline is now app/lib/cookies.ts and shared by both callers, rather than a second parser being written beside it.