Another attempt at fixing Cross-site POST form submissions are forbidden

svelte.config.js

@@ -7,7 +7,14 @@ const config = {
 	// for more information about preprocessors
 	preprocess: vitePreprocess(),
 
-	kit: { adapter: adapter() }
+	kit: {
+		adapter: adapter(),
+		csrf: {
+			// Disabled because Apple Sign In uses cross-origin form_post.
+			// The Apple callback route has its own CSRF protection via state + cookie.
+			checkOrigin: false
+		}
+	}
 };
 
 export default config;