The lusca CSRF middleware was being applied to all requests including
safe methods like GET, causing "CSRF token missing" errors for endpoints
like /api/registration-status.
CSRF protection should only apply to state-changing methods (POST, PUT,
PATCH, DELETE), not to safe methods (GET, HEAD, OPTIONS) which cannot
modify server state.
This fix adds a check to bypass CSRF validation for safe HTTP methods
while maintaining protection for all state-changing operations.
94da7a4de9