[Security] Add Origin/Referer check on mutations; move email verify off GET

[mindsers]

Summary

CSRF protection relies solely on SameSite=Lax cookies — there is no token or Origin/Referer check on mutating actions. Separately, email verification consumes its token in a loader (GET) (verify-email-confirm.tsx), so link-prefetchers can burn it.

Affected code

• Mutating route actions across features (no Origin/Referer assertion)
• app/features/authentication/routes/verify-email-confirm.tsx (token consumed in a GET loader)

Remediation

• Add an Origin/Referer assertion on mutating actions (defence-in-depth alongside SameSite).
• Move email verification to a POST / idempotent action so prefetchers can't consume the token.

Severity

Low.

---

Source: internal security review (commit 0360e87, 2026-07-21).