## an /api/geo/ route without the session check (a door)
    r970_no_hub_key_door_test.go:74: GET /api/geo/countries with the hub key answered 200 — the key opens a door
--- FAIL: TestR970_HubKeyOpensNoDoor (0.08s)
## the /config GET case back
    r970_config_routes_test.go:31: GET /api/config answered 200, want the router's 404
    r970_config_routes_test.go:31: GET /api/config/ answered 200, want the router's 404
--- FAIL: TestR970_ConfigRoutesAreGone (0.00s)
## the Bearer CSRF exemption back
    r970_csrf_test.go:40: a POST carrying the hub key passed CSRF (code 200)
--- FAIL: TestR970_HubKeyIsNoCSRFExemption (0.00s)
