1. /config/test/ — json.loads(request.body) on GET crashed with JSONDecodeError.
Added @require_http_methods(['POST']) so GET returns 405 instead of 500.
2. /organizations/dropdowns/subsections/ — LegacySubSection.objects.order_by('name')
used wrong field name (model has name_en/name_ar, not 'name'). Fixed to 'name_en'.
3. /rca/create/ — RCACreateView.dispatch() called _check_rca_create(request) before
LoginRequiredMixin ran, so AnonymousUser hit is_px_admin() → AttributeError.
Added auth check before the RBAC check in dispatch().
Post-fix: authenticated sweep of all 242 UI URLs → 233 OK, 0 errors (500s).
