[MM-10346] CSRF Token Implementation + Tests (#10067)

* CSRF Token Implementation + Tests

Remove debug statements

Implement requested changes

* Fix non-cookie authentication methods stripping auth data from requests

* Fail when CSRF cookie is not returned as part of login

model/config.go

@@ -283,6 +283,7 @@ type ServiceSettings struct {
 	DEPRECATED_DO_NOT_USE_ImageProxyOptions           *string `json:"ImageProxyOptions"` // This field is deprecated and must not be used.
 	EnableAPITeamDeletion                             *bool
 	ExperimentalEnableHardenedMode                    *bool
+	ExperimentalStrictCSRFEnforcement                 *bool
 	EnableEmailInvitations                            *bool
 	ExperimentalLdapGroupSync                         *bool
 }
@@ -611,6 +612,10 @@ func (s *ServiceSettings) SetDefaults() {
 	if s.ExperimentalLdapGroupSync == nil {
 		s.ExperimentalLdapGroupSync = NewBool(false)
 	}
+
+	if s.ExperimentalStrictCSRFEnforcement == nil {
+		s.ExperimentalStrictCSRFEnforcement = NewBool(false)
+	}
 }
 
 type ClusterSettings struct {