* feat: enable csrf token header * Exempt external auth requets * ensure dev server bypasses CSRF * external auth is just get requests * Add some more routes * Extra assurance nothing breaks
coder_env
<Box>
sx