Browser consent decision

Session-cookie endpoint the connect page calls after sign-in. Requires a same-origin Origin (CSRF). JSON body {txn, decision} where decision is allow or deny. Returns {redirect} for the browser to follow. This is not a redirect response and not a token endpoint. Requires the duan_session cookie. An API key or OAuth access token does not replace it.