Consistent with all other mutation handlers which already guard with ValidateJWTFromCookie. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>