auth

Paddy 2014-11-02 Parent:b3cd7765a7c8 Child:1dc4e152e3b0

Turn our TODO into a BUG. Lack of CSRF protection is most decidedly a bug, so let's list it as such.