A POST to the callback route is re-issued as a same-site GET carrying only
the OAuth response fields, so SameSite=Lax state cookies are sent and the
normal callback runs. Release 0.94.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>