Protect OmniAuth request phase against CSRF. Addresses #2268. See merge request !1793
mentioned in issue #64482 (moved)