Remove standard CSRF middleware for lax-proto

Previously, two CSRF middlewares were added for lax-proto requests: one
at the beginning and one at the end. This change replaces them with a
single middleware placed at the beginning. Non-lax-proto cases remain
unchanged.

Author: asaharan

.changeset/curvy-glasses-wash.md

@@ -0,0 +1,5 @@
+---
+'@builder.io/qwik-city': patch
+---
+
+fix behaviour of checkOrigin: "lax-proto" in createQwikCity

packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts

@@ -66,10 +66,10 @@ export const resolveRequestHandlers = (
       checkOrigin &&
       (method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE')
     ) {
-      requestHandlers.unshift(csrfCheckMiddleware);
-
       if (checkOrigin === 'lax-proto') {
-        requestHandlers.push(csrfLaxProtoCheckMiddleware);
+        requestHandlers.unshift(csrfLaxProtoCheckMiddleware);
+      } else {
+        requestHandlers.unshift(csrfCheckMiddleware);
       }
     }
     if (isPageRoute) {