Exercise 3: An Unauthenticated POST Never Reaches new_note_post() — Possible Solution
====================================================================

THE TEST
------------------------------
    form = b'title=Should+never+exist&body=Posted+with+no+session+at+all'

    # no Cookie header sent at all -- genuinely unauthenticated
    status, headers, body = call('POST', '/notes/new', body=form)

VERIFIED, REAL RESULT
------------------------------
    real row count before the unauthenticated POST:   2
    POST /notes/new (unauthenticated) ->  302 Found /login
    real row count after the unauthenticated POST:    2   (unchanged)
    no row with that title exists:                    True

    cross-check -- the identical POST, this time authenticated:
    POST /notes/new (authenticated)   ->  302 Found /notes/3
    real row count now:                               3

WHY THIS WORKS
------------------------------
login_required's own wrapped() function checks
request.state['session'].get('user_id') and returns
Response.redirect('/login') immediately when it's missing -- before
ever calling the real new_note_post(request) it wraps. Since Python
never evaluates the body of a function that's never called,
new_note_post() -- and therefore the real Note(...).save(conn) line
inside it -- genuinely never executes at all for the unauthenticated
request. The row count staying at exactly 2 (not 2-then-3-then-somehow-
still-2) confirms this directly, rather than trusting that a redirect
response implies nothing happened.

WHY THIS WORKS AS AN ANSWER
------------------------------
Checking only the HTTP status code would leave open the possibility
that new_note_post() ran, created the row, and then something else
redirected afterward -- a genuinely different (and worse) bug shape
than "never ran at all." Querying the real row count before and after,
and confirming no row with the attempted title exists anywhere in the
table, rules that out directly. The authenticated cross-check using the
identical form data confirms the block is specific to the missing
session, not some unrelated reason the POST might otherwise fail.