From eb0332609cd2d3cc6c0489398ec7c06863b7f6fe Mon Sep 17 00:00:00 2001
From: Brian Ridings <bdrid001@gmail.com>
Date: Thu, 27 Mar 2014 14:09:13 -0400
Subject: [PATCH 1/4] CSRF token to headers for AJAX POST. Fix for #113

This is how you do a JS post with the CSRF Protection

```
$.ajax({
url: "http://test.com",
type:"post"
headers: {'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content')}})
```
---
 views/layout.jade | 1 +
 1 file changed, 1 insertion(+)

diff --git a/views/layout.jade b/views/layout.jade
index b3980e41c4..71ac7ef9b0 100644
--- a/views/layout.jade
+++ b/views/layout.jade
@@ -5,6 +5,7 @@ html
     meta(http-equiv='X-UA-Compatible', content='IE=edge')
     meta(name='viewport', content='width=device-width, initial-scale=1.0')
     meta(name='description', content='')
+    meta(name='csrf-token', content=token)
     meta(name='author', content='')
     title #{title} | Hackathon Starter
     != css('styles')

From 05f7191c196d699bca152a766905ea4921dc8df1 Mon Sep 17 00:00:00 2001
From: Brian Ridings <bdrid001@gmail.com>
Date: Fri, 28 Mar 2014 10:37:16 -0400
Subject: [PATCH 2/4] Change token to _csrf

---
 app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app.js b/app.js
index 596278efcc..d93e47bdf0 100755
--- a/app.js
+++ b/app.js
@@ -77,7 +77,7 @@ app.use(passport.initialize());
 app.use(passport.session());
 app.use(function(req, res, next) {
   res.locals.user = req.user;
-  res.locals.token = req.csrfToken();
+  res.locals._csrf = req.csrfToken();
   res.locals.secrets = secrets;
   next();
 });

From 9587150e7befef6a0741545050908044cf8a870f Mon Sep 17 00:00:00 2001
From: Brian Ridings <bdrid001@gmail.com>
Date: Fri, 28 Mar 2014 10:38:04 -0400
Subject: [PATCH 3/4] Change token to _csrf

---
 views/account/forgot.jade | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/account/forgot.jade b/views/account/forgot.jade
index 70029f16b8..a843a1e95b 100644
--- a/views/account/forgot.jade
+++ b/views/account/forgot.jade
@@ -4,7 +4,7 @@ block content
   .col-sm-8.col-sm-offset-2
     form(method='POST')
       legend Forgot Password
-      input(type='hidden', name='_csrf', value=token)
+      input(type='hidden', name='_csrf', value=_csrf)
       .form-group
         p Enter your email address below and we will send you password reset instructions.
         label.control-label(for='email') Email

From 205318ea4264cd8330a609f4242e0abf2f46e733 Mon Sep 17 00:00:00 2001
From: Brian Ridings <bdrid001@gmail.com>
Date: Fri, 28 Mar 2014 10:38:29 -0400
Subject: [PATCH 4/4] Change token to _csrf

---
 views/account/login.jade | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/account/login.jade b/views/account/login.jade
index 5869ee6a31..dd73045a27 100644
--- a/views/account/login.jade
+++ b/views/account/login.jade
@@ -3,7 +3,7 @@ extends ../layout
 block content
   form(method='POST')
     legend Sign In
-    input(type='hidden', name='_csrf', value=token)
+    input(type='hidden', name='_csrf', value=_csrf)
     .col-sm-8.col-sm-offset-2
       if secrets.localAuth
         .form-group
@@ -37,4 +37,4 @@ block content
       if secrets.linkedinAuth
         a.btn.btn-block.btn-linkedin.btn-social(href='/auth/linkedin')
           i.fa.fa-linkedin
-          | Sign in with LinkedIn
\ No newline at end of file
+          | Sign in with LinkedIn