Account

Signed in as you (role user, uid 2)
Profile email: you@ratshop.io · role user · credits 50 · is_admin False

Update profile (JSON API)

curl -X POST /account/update -H "Content-Type: application/json" -d '{"name":"me"}'

Shipping address

Ship to: 1 Rat Street, Ratdam (you@ratshop.io)

Rewards token

Your rewards token: dXNlcj15b3UmdGllcj1icm9uemU= → redeem at /rewards?t=<token>

The JSON profile update at /account/update merges every key you send (including role, is_admin, credits). The address form is a state change with no CSRF token and also accepts GET, and your session cookie is neither HttpOnly nor SameSite. The rewards token is just base64 - forge tier=platinum.