Luca Campli

Update "Use only JSON API"

1

As you can read here: http://security.stackexchange.com/questions/10227/csrf-with-json-post JSON API are still vulnerable to CSRF if you are not checking the content type.

I find the holdToDisplay feature useful only for touch, in desktop it's not very useful. I would change the default option to be 1s for touch and 0 for mouse...