# RP10 — the pass is bound to its app host
# mutation in internal/web/setup_gate.go:
#   - 'hmac.Equal([]byte(mac), []byte(s.gateMAC("cookie", host, exp)))'
#   + 'hmac.Equal([]byte(mac), []byte(s.gateMAC("cookie", "gapp.example.hu", exp))) // RED-PROOF RP10'
# go test -run ^TestSetupGate_TheHouseholdPassesWithItsSession$ ./internal/web
# verdict: RED (assertion)
=== RUN   TestSetupGate_TheHouseholdPassesWithItsSession
    setup_gate_test.go:166: the pass for gapp opened gapp-db: 200
--- FAIL: TestSetupGate_TheHouseholdPassesWithItsSession (0.06s)
