Remove TODO about XSRF setting

Since we don't use a JavaScript frontend, we don't actually need any XSRF
protection. All of the requests will be coming from the browser, not from a
computer running inside the browser (js).

1 files changed, 1 insertions, 1 deletions

diff --git a/Biz/Devalloc.hs b/Biz/Devalloc.hs
index 04ee90e..1b76cc6 100644
--- a/Biz/Devalloc.hs
+++ b/Biz/Devalloc.hs
@@ -542,7 +542,7 @@ liveCookieSettings :: Auth.CookieSettings
 liveCookieSettings =
   Auth.defaultCookieSettings
     { Auth.cookieIsSecure = Auth.Secure,
-      -- TODO: fix this, add js snippet
+      -- disable XSRF protection because we don't use any javascript
       Auth.cookieXsrfSetting = Nothing
     }