openai/gpt-chat-latest → A (4:1)

Side A delivers substantive security and correctness improvements: voting changes from fail-open anonymous fallback to fail-closed authenticated sessions, cookies gain conditional Secure handling, OAuth mock login is gated by an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by new tests. Side B is largely a URL/path refactor that centralizes room route encoding and adds URL normalization utilities, but most changes are mechanical rewrites of routing and link generation with comparatively less impact on core correctness and security.