Add request forgery guard (CSRF)

[x1ddos]

Without CSRF, it is possible create a hidden form like this one:

<form method="post" action="https://affiliates.crisp.chat/dashboard/account/form/account/">
<input type="hidden" name="email" value="[email protected]">
<input type="hidden" name="password" value="123">
<input type="hidden" name="notify_balance" value="0">
</form>

then submit it on any user click, on the page where the form is, log in and cash out.

[x1ddos]

(precondition: account holder needs to be already logged in to affiliates.crisp.chat)

[valeriansaliou]

Ref rwf2/Rocket#14