CSRF demo

This form posts to /demos/csrf/stage, which requires a valid token.

Now try the same POST without the token:

curl -i -X POST http://127.0.0.1:8730/demos/csrf/stage -d 'stage=active'