fix(admin): CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers, validation

src/admin/views/locations.ejs

@@ -7,6 +7,7 @@
     <div class="collapse" id="addLocationCollapse">
         <div class="panel-content">
             <form method="POST" action="/locations" class="d-flex flex-wrap gap-2 align-items-end">
+                <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                 <div>
                     <label class="form-label">Country</label>
                     <input name="country" class="form-control form-control-sm" placeholder="Country" required>
@@ -44,6 +45,7 @@
                             <td><%= l.product_count || 0 %></td>
                             <td>
                                 <form method="POST" action="/locations/<%= l.id %>/delete" class="d-inline" onsubmit="return confirm('Delete location?')">
+                                    <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                                     <button class="btn btn-sm btn-danger">Delete</button>
                                 </form>
                             </td>