Reduce noisy logging

Merge pull request #13 from qld-gov-au/develop

Develop to main

Add optional protection against Login CSRF

Add a Repoze plugin that can be used to check tokens when logging in, replacing FriendlyForm. This plugin needs to be configured separately, eg in who.ini.

Disable response pass-through

We need to disable Flask response pass-through mode so that we can inject tokens into the response body. This will have a performance impact but is necessary for CKAN 2.9.

Initial release

CSRF filter based on a mixture of Double Submit Cookie and HMAC Based Token patterns.

Protects HTML-based forms and some types of JavaScript-based interaction, with no code changes required.

Does not protect API calls or prevent Login CSRF.