asdf

README.md

@@ -74,7 +74,7 @@ Environment; see *Contact form* below.
   and no third party is involved, so there is nothing to consent to. The form therefore needs
   JavaScript; without it a `<noscript>` line points to the email address.
 
-  In the container, nginx proxies `/contact`, `/contact/challenge`, `/notify` and `/notify/verify` to the handler on `127.0.0.1:3000`; both are started
+  In the container, nginx proxies `/contact`, `/contact/challenge`, `/notify` and `GET /notify/verify` to the handler on `127.0.0.1:3000`; both are started
   by `docker/entrypoint.sh`, which restarts the handler if it crashes. If the handler is down,
   visitors are sent to the error page. Without SMTP settings the handler does not start and the
   rest of the site is served as usual.
@@ -98,11 +98,11 @@ Environment; see *Contact form* below.
   shows a coming-soon page whose form posts `email`, `consent=yes`, `lang`,
   `list=cipherverifier-alpha`, the honeypot `website` and the proof-of-work answer `altcha` to
   `POST /notify`, handled by `server/contact.mjs` like the contact form. It is double opt-in
-  without a database: the handler emails the address a link to `/notify/confirm` carrying a
-  signed token (address, language, time of consent; valid 7 days) and keeps nothing. That page
-  posts the token to `POST /notify/verify` with a button (mail scanners open links, they do not
-  press buttons), and the handler sends the confirmed registration, with the consent wording and
-  both times, to `CONTACT_TO`. That mailbox is the list. The privacy page promises deletion
+  without a database: the handler emails the address a link to `GET /notify/verify` carrying a
+  signed token (address, language, time of consent; valid 7 days) and keeps nothing. Opening the
+  link confirms: the handler sends the confirmed registration, with the consent wording and both
+  times, to `CONTACT_TO`, and redirects to `/notify/confirmed`. A mail scanner that opens every
+  link in a message will confirm it too. Old `/notify/confirm` links are redirected by nginx. That mailbox is the list. The privacy page promises deletion
   after the alpha mail is sent or on withdrawal. The result pages `/notify/confirmed` and
   `/notify/error` are `noindex` and left out of the sitemap. Set the flag to false to bring back
   the full product page.