Add the cors-csrf module

cors-csrf/docs/output/09-error-dispatch.txt

@@ -0,0 +1,25 @@
+==============================================================================
+docs/output/09-error-dispatch.txt
+The identical CSRF failure, with one extra filter chain that permits /error.
+Profile: csrfnaive,errorpermit
+==============================================================================
+
+HTTP/1.1 403 
+Vary: Origin
+Vary: Access-Control-Request-Method
+Vary: Access-Control-Request-Headers
+Set-Cookie: XSRF-TOKEN=<token>; Path=/
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 0
+Cache-Control: no-cache, no-store, max-age=0, must-revalidate
+Pragma: no-cache
+X-Frame-Options: DENY
+
+{"timestamp":"<timestamp>","status":403,"error":"Forbidden","path":"/api/data"}
+
+# 403, and a body. Without the /error chain the same request answers 401 with an
+# empty body and a WWW-Authenticate header - see 08. AccessDeniedHandlerImpl calls
+# response.sendError(403), the container re-dispatches to /error, and the security
+# chain runs a second time on that dispatch. BasicAuthenticationFilter extends
+# OncePerRequestFilter and skips error dispatches, so the second pass is anonymous
+# and AuthorizationFilter answers 401 over the top of the 403.