Create or refresh this browser's goals session; hand back its CSRF token.

The page's first conversation, and its conversation again after a reload — the CSRF token lives in memory, so asking again is how the page gets back the right to take a turn in a conversation it already owns. Asking again returns the same token, so a second tab does not take that right away from the first (#1883).

A bearer gets the install's session and no cookie (#2635). The app has nothing to store one in and nothing to double-submit it against, so the answer carries no csrf_token at all and the uid is what the next turn presents. It is otherwise the same call for the same reason: ask once, learn which conversation you are in, and learn it again after a restart. It creates no account — a conversation is not a promise, and the row is born when one settles.

It is also where a reinstalled phone gets its goal back (#2637, :func:_recovered_by_device). That is a recognition rather than a creation, so the sentence above still holds: the account it hands over is one the athlete already had. The recovery runs before the session is resolved, so the answer describes a world the fold has already settled, and it still writes no device row of its own — being asked about a phone is not the athlete committing to anything on it.