auth

Paddy 2014-11-02 Parent:b3cd7765a7c8 Child:0a6e3f14b054

Turn our TODO into a BUG. Lack of CSRF protection is most decidedly a bug, so let's list it as such.