The session cookie is set Secure. It carries the reserved org's session, which
reaches every tenant, so it travels over TLS only.
`serverURL` names the host the admin and its links are built against, from
SERVER_URL, so a request header cannot decide where a reset link points. It is
also what cookie-authenticated writes are checked against, so the HTTP proof
sends its requests from that host — without it a rejected origin reads as a
denied permission.
CMS_SECRET signs every session cookie, and production now stops rather than
falling back to a value published in this file.
Scheduled publish enqueues with `overrideAccess: false`, so the job it names
answers to the jobs rule as its delete already does.
zooqueen
9228be25e6