Add CSRF protection for cookie-authenticated requests

templates/login.html

@@ -127,10 +127,14 @@
         const password = document.getElementById("password").value;
 
         try {
+            const m = document.cookie.match('(^|;)\\s*csrf_token\\s*=\\s*([^;]+)');
+            const csrf = m ? m.pop() : '';
+
             const res = await fetch("/api/auth/login", {
                 method: "POST",
                 headers: {
-                    "Content-Type": "application/json"
+                    "Content-Type": "application/json",
+                    "X-CSRF-Token": csrf
                 },
                 body: JSON.stringify({
                     username: username,