CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

tests/test_api.py

@@ -297,8 +297,16 @@ def test_self_delete(base=BASE):
 
 def test_csrf_header_required(base=BASE):
     # mutation routes without the X-Aniweb header -> 403 (a cross-site form
-    # POST can't set it; the SPA always sends it). /login is exempt.
+    # POST can't set it; the SPA always sends it). /login included (was
+    # exempt): forced-login from an attacker's cross-site form is dead.
     jar = login("admin", "adminpw12345", base)
+    r = urllib.request.Request(base + "/login", method="POST",
+                               data=json.dumps({"username": "admin", "password": "x12345678"}).encode(),
+                               headers={"Content-Type": "application/json"})  # no X-Aniweb on purpose
+    try:
+        assert urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar)).open(r).status == 403
+    except urllib.error.HTTPError as e:
+        assert e.code == 403, e.code
     r = urllib.request.Request(base + "/logout", method="POST")
     try:
         assert urllib.request.build_opener(