datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection

Datasette is shifting its CSRF protection mechanism from traditional token-based validation to a more modern approach using the Sec-Fetch-Site HTTP header. The previous token-based system, implemented through the asgi-csrf Python library, required developers to add CSRF tokens to forms throughout templates, creating friction in the development process and adding complexity to the codebase.

The Sec-Fetch-Site header is a browser-supplied security header that automatically identifies whether a request originates from the same site, a cross-site source, or a user-initiated navigation. This approach eliminates the need for manual token insertion in forms, reducing boilerplate code and simplifying template management while maintaining equivalent security against cross-site request forgery attacks.

This change reflects a broader industry trend toward leveraging modern browser security features to replace older workaround mechanisms. By adopting Sec-Fetch-Site validation, Datasette improves developer experience and code maintainability without sacrificing security, though it does require that users' browsers support these headers—a consideration for applications serving legacy browser environments.