Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.Referenceshttps://listsprd.osu.edu/pipermail/ood-users/2020-April/000397.html
