Free Claim

Count one press of a free "Claim" or "Play now" button, on a card or the game page.

The body is parsed by hand rather than as a typed parameter, so it is read whatever content type it comes with: a keepalive fetch sends JSON, and navigator.sendBeacon with a string sends text/plain.

Not counted when the browser says the call came from another site (Sec-Fetch-Site), so another page cannot press our buttons through its visitors. Older browsers send no such header and are let through: the count is anonymous and the game must exist, so the most a forger gets is a number on our own dashboard.