204 once saved, 401 without a session, 400 for a body that is
not a playback position
Remarks
navigator.sendBeacon is the one request a closing page is allowed to
finish, and it cannot call a Server Action — so the last position of a
session arrives here as a bare body. The learner is whoever the session
cookie says; the body only names the lesson and the seconds.
The page-hide flush of the playback position.