review code pattern consistency

app/login/api/engine/onboarding.php

@@ -73,7 +73,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
         http_response_code(403);
-        exit(json_encode(['message' => 'Invalid request.']));
+        $answer['message'] = 'Invalid request.';
+        exit(json_encode($answer));
     }
 }
 
@@ -142,7 +143,7 @@ try {
     // Sends a test email to the onboarding user's registered address.
     // If the mailer throws or exits, no DB records have been created yet,
     // so the user can correct their SMTP settings and retry cleanly.
-    require_once $include_url . 'assets/utils/module/mailer.php';
+    require_once '../../../assets/utils/module/mailer.php';
 
     $mailer = new mailer(['pdo1' => $pdo1]);
     $mailer->send_email([