You can leave this in if you'd like, but this is actually not vulnerable. The `/login/facebook` endpoint is specifically excluded from CSRF protection, while this one isn't. See `csrf_protect` in `server/server.py`.