[lixtra]

The encrypted content should be served (and burned server-side) only to a POST request. No sane service can expect a POST request to be idempotent and therefore shouldn’t fire it (twice).