B blog.miguelgrinberg.com CSRF protection without tokens or hidden form fields 22 points ibobev 10 months ago 15 comments