Custom auth headers cannot reach navigations or sendBeacon

When retrofitting access control onto a web app, classify routes by how they are invoked: fetch, top-level navigation (pasted permalink), navigator.sendBeacon, or server-to-server. A custom header such as X-Access-Key works only for fetch and server calls, which pushes teams toward ?key= URL parameters that end up in logs and history. A cookie rides on navigations and beacons without extra code, so a session cookie removes the need for the query-param fallback in the browser.