openai/gpt-chat-latest → A (3:2)

Side A makes several lasting security and correctness improvements: voting now fails closed by requiring a valid authenticated session instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, OAuth mock login is gated behind an environment flag, and return URL sanitization is strengthened with tests to block additional open-redirect forms. Side B contains useful architectural cleanup (removing the demo counter, introducing cached rankings and a settlement worker), but much of it is refactoring/performance-oriented, whereas Side A directly fixes security and authorization behavior with concrete user-facing correctness benefits.