Pin the empty Origin branch with a server-built request

HttpClient drops an empty header value, so the first version of the test
never sent the header; the request is now built on the TestServer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Bifrost.Web.Tests/ConceptVotePageTests.cs

@@ -4,6 +4,7 @@ using Bifrost.Web.Data;
 using Bifrost.Web.Domain;
 using Bifrost.Web.Tests.Support;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
@@ -190,12 +191,27 @@ public sealed partial class ConceptVotePageTests : IClassFixture<TestWebApplicat
     {
         var collection = NewCollection();
         await AddSubject(collection, "alpha");
-        var visitor = NewVisitor(anonymous: true);
 
-        using var response = await visitor.Post(collection, "alpha", "Up", origin: string.Empty, fetchSite: fetchSite);
+        // HttpClient drops a header whose value is empty, so the request is built on the server itself, where an
+        // Origin header with an empty value is present in the dictionary as a browser's would be.
+        var context = await _factory.Server.SendAsync(http =>
+        {
+            http.Request.Method = HttpMethods.Post;
+            http.Request.Scheme = "https";
+            http.Request.Host = new HostString("localhost");
+            http.Request.Path = $"/mill/{collection}/alpha";
+            http.Request.QueryString = new QueryString("?handler=Up");
+            http.Request.ContentType = "application/x-www-form-urlencoded";
+            http.Request.Headers["X-Test-Anonymous"] = "true";
+            http.Request.Headers["Origin"] = string.Empty;
+            if (fetchSite is not null)
+            {
+                http.Request.Headers["Sec-Fetch-Site"] = fetchSite;
+            }
+        });
 
-        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
-        Assert.False(response.Headers.Contains("Set-Cookie"));
+        Assert.Equal(StatusCodes.Status403Forbidden, context.Response.StatusCode);
+        Assert.False(context.Response.Headers.ContainsKey("Set-Cookie"));
         Assert.Empty(await Rows(collection, "alpha"));
     }