auth

Paddy 2014-11-02 Parent:e0b3064daf02

Turn our TODO into a BUG. Lack of CSRF protection is most decidedly a bug, so let's list it as such.