yesodweb/yesod — pull request #854 by paul-rouse (2014-10-21 08:21:14+00:00)
Title: Redirect dynamically in GoogleEmail2 login page

I think it is better to redirect dynamically every time, instead of building the Google URL into the login page, because it:

* Avoids the error "Invalid CSRF token from Google" when the session disappears in the time between loading the login page and trying to use it, for example if a user
* logs out, deletes recent browser history, and tries to log back in, or
* simply leaves the login page lying around for a while, so that the session expires.

* Makes the session cookie smaller when an alternative authentication method (other than Google) is used for a particular login, because the CSRF token will not be added in that case.