reload protector should defer deletion of cookie.

[komuw]

ong/middleware/reload_protect.go

Lines 18 to 28 in 0760665

	func reloadProtector(wrappedHandler http.Handler, domain string) http.HandlerFunc {
	safeMethods := []string{
	// safe methods under rfc7231: https://datatracker.ietf.org/doc/html/rfc7231#section-4.2.1
	http.MethodGet,
	http.MethodHead,
	http.MethodOptions,
	http.MethodTrace,
	}
	return func(w http.ResponseWriter, r *http.Request) {
	// It is possible for one to send a form without having added the requiste form http header.
	if !slices.Contains(safeMethods, r.Method) {

		defer func() {
			cookie.Delete(
				w,
				theCookie,
				o.Domain,
			)
		}()

There's a bug where all second legitimate submissions of from fail

[komuw]

I don't think there's a bug. I had a html form like;

<form>
<button id="resetButton">Reset</button>
</form>

And everytime I would press the button it would submit an empty form, which I would presume to be a bug in ong.
But what I needed is;

<button id="resetButton" type="button">Reset purchase</button>
<!-- Make sure the button has a type==button so that it doesn't submit which is the default action for butoons. -->

[komuw]

https://en.wikipedia.org/wiki/Post/Redirect/Get