doorkeeper-gem/doorkeeper — pull request #529 by jdjkelly (2014-12-17 20:59:07+00:00)
Title: Adds CSRF protection to ApplicationMetalController

Per c1b5c45e2c42c0191ca9f12a2836e31ee1a8de57, this adds forgery protection to
ApplicationMetalController - which is used by TokensController#create. As a result, it is possible
to phish access tokens through the password grant flow on a third party site.