tree fc5ec531cf30dcbe6eb9925aec27c2244bf29f74
parent 038f61d5a4c4d4a90429e61caf57bcf2da87b840
author Bogdan Caprita <caprita@google.com> 1464392249 -0700
committer Bogdan Caprita <caprita@google.com> 1464392249 -0700

allocatord: relax csrf requirement for non-mutating handlers

With the debug browser integration, it's no longer practical to pass
csrf tokens around for all requests and handlers.  Consequently, we're
now going to only require csrf tokens for mutating requests.  For
non-mutating requests, the redirect through the oauth flow was not
adding much security (Asim and I discussed this a while back).

For now, keep the CSRF token in the email cookie so that it's easily available
for constructing mutating URLs.  It could be its own cookie in theory.

Change-Id: Ia6179947d19a59ffcd484f56db5d34351087ce83