second attempt to add the VCF exporter

The VCF exporter finally generates output that can be used in R.
I exempted this, because the csrf check fails when a tool other than a Web browser invokes the exporter with a POST request.  How recently was that feature added to token authentication?  I added that under an older version of Serrano.