mozilla/affiliates — pull request #218 by Osmose (2014-05-22 15:06:28+00:00)
Title: Bug 1014273: Do not cache CSRF token view.

The production site seems to be caching the index page and CSRF token
view used by django_browserid to fetch a token for POSTing the Persona
assertion. This causes failures when logging in as you POST with a
cached token. Trying to login again works, however, because the failed
POST doesn’t get cached and you get assigned a proper token, which
updates your CSRF cookie. Since you now have a different cookie and all
requests vary by cookie while not logged in, the second time it will
fetch the correct token and POST it properly.

By marking the CSRF view as not cached, we force the request to set a
CSRF cookie and to send the correct CSRF token, which means the POST
that follows it will go through correctly.