Helpers: PASS normalizeMpesaPhone accepts 07XXXXXXXX format PASS normalizeMpesaPhone accepts 01XXXXXXXX format PASS normalizeMpesaPhone accepts already-international format PASS normalizeMpesaPhone strips non-digit formatting PASS normalizeMpesaPhone rejects too-short numbers PASS normalizeMpesaPhone rejects non-Kenyan prefixes PASS cleanInput trims whitespace without escaping PASS sanitize escapes HTML for safe output PASS sanitize trims before escaping PASS csrfIsValid rejects when session has no token PASS csrfIsValid rejects a mismatched token PASS csrfIsValid accepts a matching token PASS csrfIsValid rejects empty string token PASS csrfIsValid rejects null token PASS thumbnailUrl passes through absolute URLs unchanged PASS thumbnailUrl returns null for empty input PASS thumbnailUrl resolves relative paths against base_url Auth: PASS resolveRegistrationRole allows self-service learner role PASS resolveRegistrationRole allows self-service tutor role PASS resolveRegistrationRole allows self-service affiliate role PASS resolveRegistrationRole downgrades a spoofed superadmin request to learner PASS resolveRegistrationRole downgrades an unknown role string to learner PASS resolveRegistrationRole grants superadmin only to allow-listed emails PASS resolveRegistrationRole allow-list wins even if a role was also requested 24/24 passed