Version 0.91.1

The operator-only endpoints no longer reveal that they exist without the operator key.

The operator endpoints are locked twice: by the edge service in front of the site, and by a key each of them checks. That key check runs inside the endpoint, but the framework reads the body first — so a request with no key got different errors depending on the shape it sent. Somebody past the first lock could learn from those differences which operator addresses exist and what each one expects. They now all answer the same thing, and the key check inside each endpoint stays where it was.