bravecollective/core — pull request #267 by jboning (2014-07-16 07:36:08+00:00)
Title: Fix authorization under csrf protection

Since the authorization page was posting to window.location, the url was
absolute, and the external-xhr check was triggering.

I cannot believe this is how one parses a URL in javascript.