CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

server/app.py

@@ -158,8 +158,10 @@ async def csrf_header(request, call_next):
     # SameSite=Lax cookie, so <form action=.../account/delete> from a
     # malicious page would work; forms can't set a custom header, the SPA
     # always sends it. Runs *after* require_auth (registered earlier), so
-    # unauthenticated requests still get 302/401 first.
-    if request.method in ("POST", "DELETE") and request.url.path != "/login":
+    # unauthenticated requests still get 302/401 first. /login is covered too
+    # now (was exempt): forced-login from an attacker's cross-site form is
+    # dead on arrival, and login.html sends the header like everything else.
+    if request.method in ("POST", "DELETE"):
         if request.headers.get("x-aniweb") != "1":
             return JSONResponse({"detail": "forbidden"}, status_code=403)
     return await call_next(request)