auth

Paddy 2014-11-02 Parent:dd5d23d490ee Child:c29c7df35905

Turn our TODO into a BUG. Lack of CSRF protection is most decidedly a bug, so let's list it as such.