Record Consent

Keep one cookie decision. 204 and nothing else: the site does not wait.

The body is parsed by hand rather than as a typed parameter so it is read whatever content type it comes with — a keepalive fetch sends JSON, and navigator.sendBeacon with a string sends text/plain — and so its size is capped before it is parsed.

Refused with 403 when the browser says the call came from another site (Sec-Fetch-Site): a page elsewhere must not be able to write consent records through its visitors' browsers. Older browsers send no such header and are let through; the most a forger gets is a row that names a random id nobody holds, and no visitor's own answer (in their browser) changes.