Accept only application/json for /login and /register

[mdeggies]

To eliminate security issues in the future, we're going to make sure the /login and /register endpoints accept only application/json. In the event of CSRF attacks, CORS errors will be thrown. -Robert's idea

[kirps]

@mdeggies Is there a timeline on this?

[mdeggies]

@kirps sorry I'm just seeing this now! I will check on this for you.

[mdeggies]

@kirps After speaking with the JS team, this is a much larger task than anticipated, and will not be completed in the short term. Implementing csrf protection for your app will mitigate any security related issues, and can be achieved with tools like csurf or csrf.