Preserve browser Origin on the confirmed sign-out form

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/server/oidc/account.go

@@ -47,7 +47,8 @@ Applications that already have their own sessions may remain signed in.</p>
 
 func (h *AccountLogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Referrer-Policy", "no-referrer")
+	// Keep the same-origin POST Origin; no-referrer makes Chromium send Origin: null.
+	w.Header().Set("Referrer-Policy", "same-origin")
 	w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	switch r.Method {

src/internal/server/oidc/account_test.go

@@ -31,6 +31,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) {
 	if w.Code != 200 || w.Header().Get("Location") != "" {
 		t.Fatal("GET must only confirm")
 	}
+	if w.Header().Get("Referrer-Policy") != "same-origin" {
+		t.Fatal("browser POST would lose its Origin")
+	}
 	c := w.Result().Cookies()[0]
 	if !c.Secure || !c.HttpOnly || c.Domain != "" {
 		t.Fatal("unsafe CSRF cookie")