mozilla/django-browserid — pull request #251 by Osmose (2014-05-25 06:24:49+00:00)
Title: Fix #247: Execute lazy callables for csrf_token within the view.

Django’s CSRF middleware does not send a CSRF cookie if the csrf_token
value, which is a lazy-evaluated value, is called. This avoids
unnecessary cookies, but causes trouble if you don’t evaluate the
csrf_token within your view.

CsrfToken was doing just that, as it just passed the value to
HttpResponse, not evaluating csrf_token before the middleware ran and
decided not to send the cookie. By `unicode`ing the value we force it
to run and the middleware sends the cookie as expected.