Well, you learn something every day. If an exception is thrown and handled by the exception handlers, the original request is used, not a request that has been augmented by any middleware unless you make the middleware a "global" middleware

I want to use Ring’s anti-forgery middleware (`wrap-anti-forgery`) with the built-in session middleware (`wrap-session`) and apply it to only selected routes (e.g. / but not /api). If I use the :reitit.middleware/registry option and add them via :middleware on certain routes, will that create individual, separate sessions for each route? Or should I be using the :data option?