Describe who is asking for consent, for the consent screen. Read-only.The ticket is only peeked at, never consumed, so the claim that follows still works. It is a bearer secret, which is why this is a POST: the ticket stays out of access logs. Same host binding as the claim.Authenticated by a one-time ticket in the request body.