Lost security fix: protecting /login from forgery
Merge branch 'development' into forms-validation