POST // (protocol-relative, cross-origin)

POST \\ (backslash, cross-origin)

POST HTTP:// (uppercase scheme, cross-origin)

POST /api (same-origin control — token expected)

GET /api (control — no token ever)