diff --git a/server.js b/server.js
index a9cc49b..6fa4526 100644
--- a/server.js
+++ b/server.js
@@ -1230,15 +1230,15 @@ const server = http.createServer(async (req, res) => {
       const devHdr = fraud.deviceOf(req) ? undefined : { 'Set-Cookie': fraud.deviceCookie(fraud.newDeviceId(), IS_PROD) }; // browser id for one-account-per-person checks
       if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' });
       const prev = emailCodes.get(e);
-      if (prev && Date.now() < prev.nextAt) { console.log('signup-guard cooldown', clientIp(req), e.replace(/^(.).*(@.*)$/, '$1***$2')); return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' }); }
+      if (prev && Date.now() < prev.nextAt) { console.log('signup-guard cooldown', clientIp(req), e.replace(/^(.).*(@.*)$/, '$1***$2')); return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' }, devHdr); }
       const guard = codeGuard(req, b); // honeypot, form age, per-IP + global limits, icon check once limited
-      if (guard) return json(res, guard.status, guard.body);
+      if (guard) return json(res, guard.status, guard.body, devHdr);
       const code = String(Math.floor(100000 + Math.random() * 900000));
       emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
       if (mailer.hasKey()) {
         try { await mailer.sendCode(e, code); } catch (err) {
           console.error('sendCode failed', err.message);
-          return json(res, 502, { error: 'Could not send the email. Try again in a minute.' });
+          return json(res, 502, { error: 'Could not send the email. Try again in a minute.' }, devHdr);
         }
         return json(res, 200, { ok: true, sent: true }, devHdr);
       }