Switch CSRF token from per-request to per-session

This patch switches the CSRF token handling from per-request to
per-session. The per-request behavior was overly aggressive, and it
restricted parallel browsing (e.g. multiple open browser tabs).

gavel/controllers/csrf_protection.py

@@ -5,7 +5,7 @@
 @app.before_request
 def csrf_protect():
     if request.method == "POST":
-        token = session.pop('_csrf_token', None)
+        token = session.get('_csrf_token', None)
         if not token or token != request.form.get('_csrf_token'):
             abort(403)