Payment success-page bypass: verify payments server-side

Here's the pattern. The user clicks Buy, pays on Stripe Checkout, and Stripe redirects them to /success. The success page runs code that marks the account as paid: it sets a flag in local storage, cal