Record how this account first arrived (first touch)

Session + CSRF required. The console posts the utm_* parameters and Google click id (gclid, gbraid, wbraid) the visitor first arrived with, once, after the account exists. Write-once: the first post wins and later posts return recorded: false. Accepted only within 24 hours of the account being created, so a later ad click never rewrites how an existing account came to us.