ezsystems/ezpublish-kernel — pull request #331 by bdunogier (2013-04-29 10:58:56+00:00)
Title: Fix EZP-20785: only validate CSRF token when a session is running

See https://jira.ez.no/browse/EZP-20785.

The title says it all.

# Testing
1. Try to run an unsafe operation using REST with basic auth (create content). Check that it doesn't fail.
2. Create a session using REST (see the --session HTTPie option in recent versions), try to log out (DELETE /user/sessions/) without a CSRF token => should fail, try to log out without it => should succeed