UWFlow/rmc — pull request #100 by divad12 (2014-03-02 21:58:10+00:00)
Title: Exclude /api/v1/login/facebook from CSRF protection

@phleet Review please?

Fixes #83

Although 18fcc72 prevents an attacker from replacing a logged-in user's account with the attacker's account, it doesn't prevent an attacker from just logging in a logged-out user as the attacker. I'm not sure what to do about that. :/

The CSRF token can be extracted from the session cookie (that's returned by this endpoint) if API clients require it.

### Test plan

Before fixes, ran

```
curl -i -d 'fb_access_token=...' 'http://localhost:5000/api/v1/login/facebook'
```

... which returned a 403 Forbidden. After fix, returned 200 with a session cookie in the header.

Also verified that a CSRF attack on this endpoint on a logged-in user will fail, like the following:

```html

```