user, uid 2)user · credits 50 · is_admin Falsecurl -X POST /account/update -H "Content-Type: application/json" -d '{"name":"me"}'dXNlcj15b3UmdGllcj1icm9uemU= → redeem at /rewards?t=<token>The JSON profile update at /account/update merges every key you send (including role, is_admin, credits). The address form is a state change with no CSRF token and also accepts GET, and your session cookie is neither HttpOnly nor SameSite. The rewards token is just base64 - forge tier=platinum.