e69f991aa6
By default CSRF protection is disabled for all views, since most web endpoints and all API endpoints do not need it. On the views that require it, we use the current_app.csrf.protect() method.