Fix CSRF annoyance

[chadwhitacre]

Redux of #4184 (I couldn't help but close it in the course of gratipay/inside.gratipay.com#884 (comment)).

---

We're getting a ridiculous number of TypeErrors from trying to constant_time_compare one or two Nones. Sup with that?

[chadwhitacre]

Looks like H1-123942 (we serve the entire UI on the assets.gratipay.com subdomain) is potentially implicated. I see this URL in the Sentry report—though Sentry is sampling so who knows if this is truly a factor:

POST /assets/on/openstreetmap/redirect HTTP/1.1,

[rohitpaulk]

https://sentry.io/gratipay/gratipay-com/issues/79907897/

[rohitpaulk]

Definitely looks like this is related to Hackerone, looks like a bot is running different combinations of known exploits - every event has a different item in it:

For example:

action=opt-in&then=L2Fzc2V0cy90b3VjaC8/ZXRhZz1xUVF2S05ibGpiSlBhMlVwbWYyZzRnfn4%3d&user_id=&csrf_token='"><svg%2fonload%3d(new(Image)).src%3d'%2f%2fhdyqcl0il5t505ov4g2vf1efr6xxrplf97zvrik69\56burpcollaborator.net

[rohitpaulk]

Looks good now. Merging

[chadwhitacre]

@rohitpaulk I hadn't actually committed a fix here yet. 😜

[rohitpaulk]

Haha, man how did I miss that