auth

Paddy 2014-11-02 Parent:b3cd7765a7c8 Child:42bc3e44f4fe

Turn our TODO into a BUG. Lack of CSRF protection is most decidedly a bug, so let's list it as such.