CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

tests/test_browser.py

@@ -114,7 +114,7 @@ async def _history_page_and_delete():
     op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
     op.open(urllib.request.Request(BASE + "/login",
               data=json.dumps({"username": "erin", "password": "erinpw12345"}).encode(),
-              headers={"Content-Type": "application/json"}, method="POST"))
+              headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))
     for n in range(1, 6):  # 5 entries: makes the home "history →" link render
         e = {"title": f"Hist {n}", "slug_id": f"hist-{n}", "season_id": n, "ep_id": n,
              "lang": "eng", "ep": n, "pos": 5, "dur": 600}
@@ -212,7 +212,7 @@ async def _recent_searches():
     op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
     op.open(urllib.request.Request(BASE + "/login",
               data=json.dumps({"username": "alice", "password": "alicepw12345"}).encode(),
-              headers={"Content-Type": "application/json"}, method="POST"))
+              headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))
     op.open(urllib.request.Request(BASE + "/api/searches",
               data=json.dumps({"q": "chainsaw"}).encode(),
               headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))