readFields falls back to r.Form, which includes the query string, so
POST /backend-link/show?code=... and /confirm?code=... worked and put the
code into access logs. Both routes now read the code from the body only
(JSON or a form body).
- TestMemberTokenScopes walks E-2's acceptance list item by item, plus the
per-application catalog and the legacy MintAPIToken fallback;
TestMemberTokenScopesBoot (no Docker) the boot refusals
- TestBackendLinkAuthTime (C-CR-02), TestBackendLinkShowPost (C-WR-01,
C-IN-06), TestAccessRevocation (C-CR-01), TestUserMCPGuardClientIP
(C-IN-04), TestAPITokenRevokeEvent (C-IN-02), TestOrganisationLogo (E-1)
- README Testing section names them
