Wipes this object for POST /retire. The front worker has already refused the primary and
written the audit entry; this checks the token again where the secret lives, and the confirm
against the object's own name.
A caller with no token is accepted only under force=1, when the front worker says the
deployment primary vouched for it and this object holds no owner token of its own. The header
cannot come from outside: a __ route is refused there, and the front builds this request.
Wipes this object for
POST /retire. The front worker has already refused the primary and written the audit entry; this checks the token again where the secret lives, and the confirm against the object's own name.A caller with no token is accepted only under
force=1, when the front worker says the deployment primary vouched for it and this object holds no owner token of its own. The header cannot come from outside: a__route is refused there, and the front builds this request.