curl to fetch

Because quoting breaks them. A header value can contain a colon, a body can contain single quotes, and a line continuation splits a flag from its value. The command line is tokenised the way a shell tokenises it, so `-H "Authorization: Bearer a b"` stays one header instead of two.

They are listed under "Not modelled" and left out of the snippet. Silently dropping something like --data-binary @file would produce a snippet that posts an empty body, which is worse than telling you it needs attention.

Because the browser enforces the server’s CORS policy for cross-origin requests, and a terminal does not. The snippet is correct; the server has to allow your origin. For a request the browser will not send, run it from a server or a Node script.

They are converted — -u becomes an Authorization header — and the page warns you, because the output now contains them. Nothing is uploaded, but the snippet is still a secret once you paste it somewhere.