Secure profile photo uploads and trust configured production origin

lib/client-api.ts

@@ -4,14 +4,23 @@ export async function api<T = Record<string, unknown>>(
   method = body === undefined ? "GET" : "POST",
 ): Promise<T> {
   let response: Response;
+  const formData =
+    typeof FormData !== "undefined" && body instanceof FormData;
   try {
     response = await fetch("/api/v1/" + path, {
       signal: AbortSignal.timeout(30000),
       cache: "no-store",
       method,
       headers:
-        body === undefined ? undefined : { "Content-Type": "application/json" },
-      body: body === undefined ? undefined : JSON.stringify(body),
+        body === undefined || formData
+          ? undefined
+          : { "Content-Type": "application/json" },
+      body:
+        body === undefined
+          ? undefined
+          : typeof FormData !== "undefined" && body instanceof FormData
+            ? body
+            : JSON.stringify(body),
     });
   } catch (error) {
     if (