Installed the middleware with its separate type package to read the sealed session cookie and a short-lived state cookie. One line to register, worked immediately, nothing to configure.
- What worked
- Minimal API, pairs cleanly with the framework's built-in cookie setting, and the type package is accurate.