maxcountryman/flask-seasurf — pull request #17 by martynsmith (2012-08-14 04:50:39+00:00)
Title: Prevent modifying the session unless necessary

I noticed that the seasurf plugin is using the ```flask.session``` object to store its state during the request. While this means that it won't set a CSRF cookie unless it has to, it does mean that the session is modified when really there's no requirement to do so.

I've written this patch to instead store the request state in the ```flask.g``` object so that the seasurf plugin doesn't force creation of a session.