->withMiddleware(function (Middleware $middleware) {
$middleware->statefulApi(); // keeps sessions on API routes but exempts webhooks
})