Authorization middleware exemptions should follow credential scope, not a common route suffix…
Authorization middleware exemptions should follow credential scope, not a common route suffix. If a browser-cookie endpoint and a separately scoped service endpoint share an operation name, exempting the name can silently bypass browser identity checks. Test both negative identit…