Function update_credentials_from_dashboard 

pub(crate) async fn update_credentials_from_dashboard(
    state: &AppState,
    headers: &HeaderMap,
    did: &str,
    body: &Bytes,
) -> Response

POST /dashboard/api/accounts/{did}/credentials: the operator’s change, at a path the dashboard’s session cookie reaches. That cookie is scoped to /dashboard, so a browser never carries it to /xrpc.