Try not to crash the ftp browser when there is a directory named README
Enable CSRF protection by default

Most of these forms look pretty benign, but the user profile form, which
includes an SSH key field, certainly needs to be protected.

The survey form is unprotected because it's served over insecure HTTP
and the Varnish proxy strips cookies, which is required by the builtin
CSRF protection.

Marti Raudsepp
Make all steps of password reset run over SSL

This requires the creation of views with @require_ssl set that calls
into the core django views. Otherwise, when deployed in production,
the middleware will catch these requests and direct them out of SSL.

This has always been a problem, but it broke probably when we turned on
CSRF protection, since the cookie required is no longer passed through.
More complete version of the move of the password views

The previous one missed a number of parameters which caused it to throw
exceptions when used.
Exclude CSRF token and check for the bug submission form
Remove csrf from more views that were broken
Make links to unsupported versions be rel=nofollow

This should hopefully decrease their scoring a bit in external
search engines.
Remove extra closing tag
Add specific view for handling CSRF failures

This generates the error in a bit nicer way inside our framework,
instead of throwing the default django error.
Fix CSRF verification in /admin/mergeorg/ and /admin/purge/

All templates using {% csrf_token %} need to be rendered with a
RequestContext.

This reverts most of commit 58a08f25901079c309d0713223e12c223b413d2c

Also permit POST requests to /search/ -- these aren't relevant to the
site itself, but this used to be allowed before.
Update @ssl_required decorator to play nice with other decorators

The decorator now retains all attributes of the original view and adds a
new 'view.ssl_required = True' attribute.
Fix small bug in api_varnish_purge error path

HttpServerError is a function that returns HttpResponse, not an
exception.
CSRF verification failure now returns HTTP 403 Forbidden, not 200 OK
Make the mailinglist subscription form csrf exempt, so it works again
Add sponsor logos for Google and Garden Grove
Clarify that ^ is added to all varnish purge expressions automatically
Show purge type in list of recent varnish purges
Update releases
Support UTF8 encoded URLs in community authentication

Commit 8b3726b7d866d614c842ca90593187e726a6cf3e fixed this for all
login fields except the URL redirect field (such as the users name).
But the wiki in particular uses UTF8 in the URLs, so we need to deal
with them in the URL as well.
Add ability to approve events by batch