Good point, I'll add this comment:
# Since the LTI session is initiated by a POST, to receive the request we also need to skip the CSRF check.