Replace hand-rolled CSRF tokens with http.CrossOriginProtection

[paskal]

Drops the per-request CSRF token cookie + hidden form field in favour of Go 1.25's http.CrossOriginProtection middleware (one line in server/server.go). The middleware checks the browser-set Sec-Fetch-Site header with an Origin vs Host fallback for older clients, so no client-side instrumentation is needed.

Why

Sec-Fetch-Site is a forbidden header -- the browser sets it and JS cannot forge it. It's been shipped in all major browsers since 2023 (96%+ global coverage per Can I Use), and OWASP elevated it from defence-in-depth to a primary defence in its CSRF cheatsheet in December 2025. Compared to the hand-rolled double-submit token it replaces:

• no template instrumentation (CSRFToken field, hidden <input>)
• no cookie management (csrf_token set/clear lifecycle, 5-min TTL)
• no risk of stale-token UX bugs across tabs / back button
• distinguishes same-origin from same-site, so subdomain attacks (which SameSite=Lax permits) are blocked

What changed

• server/server.go -- router.Use(http.NewCrossOriginProtection().Handler) added to the existing middleware chain
• server/auth.go -- removed generateCSRFToken, CSRFToken template field, all csrf_token cookie lifecycle code in handleLoginPage / handleLoginSubmit / renderLoginError
• server/templates/login.html -- dropped the hidden csrf_token input
• server/auth_test.go -- new TestCrossOriginProtection covering same-origin / cross-site / origin-host-mismatch / non-browser cases; obsolete "missing/invalid CSRF token" subtests removed
• main_test.go -- integration tests no longer thread a CSRF token through the login flow

Net: ~190 LoC removed.

References for context

• Go 1.25 release notes -- net/http.CrossOriginProtection
• pkg.go.dev -- http.CrossOriginProtection
• Filippo Valsorda, Cross-Site Request Forgery -- the research the stdlib middleware is based on
• Datasette PR #2689 -- Simon Willison removed all CSRF tokens from Datasette in April 2026 using the same algorithm
• OWASP CSRF Cheatsheet -- Fetch Metadata as primary defence

Notes

• weblist already requires Go 1.26, so the stdlib middleware is available without a backport.
• SameSite=Lax on the auth session cookie remains as defence-in-depth.
• For TLS-terminating proxies the middleware compares Origin host against r.Host (HSTS recommended to prevent HTTP→HTTPS downgrades). The Sec-Fetch-Site path is checked first and is unaffected by proxy schemes.

[umputun]

lgtm - swapping 190 LoC of hand-rolled crypto/cookie plumbing for one stdlib line is a win, and the new middleware actually expands CSRF coverage: the old double-submit was only on /login, now /upload, /download-selected, /partials/selection-status are protected too.