This will redirect you to Google, then Google will redirect back to:
https://www.portal.luciapos.com/callback.php
That second redirect — landing back here with ?code=... in the URL —
is the exact moment that gets blocked by ModSecurity on the main domain. This test
exists purely to see whether the same thing happens here, on a subdomain.