fa3050a17c
Anonymous users have no CSRF cookie, so require_csrf_token always raises 403 on first visit. This broke all first-time logins and registrations. CSRF protection is unnecessary here since there's no authenticated session to forge requests against.