Session-Protected Route With Better Auth

Specify a session-protected route using Better Auth (or the auth library I name). The page and the server action must both check the session. STACK Framework: [NEXT.JS APP ROUTER | SVELTEKIT | HONO] Library: [BETTER AUTH | AUTH.JS] Where the session lives: [COOKIE] Roles: [USER | ADMIN] Data the page loads: [WHAT] DELIVER 1) The server helper getSessionOrRedirect and getSessionOr401. Show why a layout check is not enough for a server action. 2) A protected page that reads the session on the server and does not flash user data on the client before the check. 3) A server action that re-checks the session and the role, and scopes the database query by user id from the session, not from form input. 4) The test: logged out, logged in as the owner, logged in as someone else. Name the assertion for each. 5) Cookie flags you expect: httpOnly, secure, sameSite, and what breaks in local http if secure is on. Do not trust a user id hidden in a form field. Do not put the session token in localStorage.