CSRF protection using HMAC-signed state tokens

No pipelines have been run yet.