#csrf

Anti-forgery check stepped aside for any request that mentioned a token

The scheduling app skips its forgery check whenever a token-named field or login header shows up, without checking the token. Whether that's reachable today depends on what each endpoint does before the guard runs, and the guard can't see that.