CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

static/login.html

@@ -49,7 +49,7 @@ const next = new URLSearchParams(location.search).get("next");
 async function login() {
   $("err").textContent = "";
   const r = await fetch(BASE + "login", {method: "POST",
-    headers: {"Content-Type": "application/json"},
+    headers: {"Content-Type": "application/json", "X-Aniweb": "1"},
     body: JSON.stringify({username: $("user").value, password: $("pw").value})});
   if (r.ok) {
     location.href = next ? BASE + next.replace(/^\/+/, "") : BASE;