Crown Town Compost portal via curl (no MCP)

crowntowncompost.com is only a marketing site. All customer data lives at portal.crowntowncompost.com — a Django app (a white-labeled StopSuite hauler platform; it CNAMEs to crowntown.stopsuite.com).

It is reachable server-side: no bot wall, no browser bridge, no fpx, no Transporter extension. Auth is a real username + password form POST that returns an HttpOnly sessionid cookie. curl with a cookie jar reaches everything a signed-in customer can see.

Two of the richest surfaces are clean JSON endpoints (service history and billing); the rest are server-rendered HTML.

The one thing that trips people up: Django CSRF

Every POST (including the login and the two JSON reads) needs all of: