Security findings auth bypass risk + open redirect in Supabase middleware

[flowlesstj-create]

Hi @Jacob-A11,

I ran an automated security audit on this repo and found
a few things worth flagging before you go live with real users.

Already broken:

• Cookie manipulation in middleware request.cookies is
  immutable in Next.js, so session cookies may not be
  persisting correctly. Silent failure in production.

• Missing https:// prefix on VERCEL_URL in signUpAction
  email redirect links will be malformed in production,
  breaking your auth flow.

Hidden vulnerabilities:

• Auth bypass risk improper cookie handling creates a
  potential session fixation vector

• Open redirect potential unvalidated redirect logic in
  encodedRedirect combined with raw VERCEL_URL usage

• Error information leakage unhandled getUser() exceptions
  could expose stack traces in production

Fixes here (auto-generated PR with diffs):
flowlesstj-create#1

I built the tool that found these FlowLessAI (flowlessai.one).
Happy to answer any questions about the findings.