also looking at this

Close unauthenticated /api/requests CRUD, and make the session cookie HttpOnly

#77

Merged glennmichael123 wants to merge fix/request-autocrud-and-httponly into main

11 files +552 -57

7a8ff6bba4 fix(security): close unauthenticated auto-CRUD on /api/requests glennmichael123 review this step
761414faa9 fix(security): move the session token to an HttpOnly cookie glennmichael123 review this step
31b4740f6b fix(test): scope the DOM to the file that needs it glennmichael123 review this step