In order to get CSRF protection, we must add the `csrf_token` to our forms and make the client extract that token and add it to their POST.  It's probably not a big code change, but it won't be trivial to find out how to weave it into Lino and test it. See [url docs.djangoproject.com/en/1.11/ref/csr...].