Don't put csrf protection on endpoint that we use to set csrf cookie.

[rtibbles]

Summary

• Removes csrf_protect decorator from the session endpoint as this was preventing the csrf cookie from being set for fresh browser sessions on first page load

References

Fixes #12305

Small regression introduced by https://github.com/learningequality/kolibri/pull/11978 - so this is new in 0.17

Reviewer guidance

Open an incognito window Navigate to kolibri See that the login page renders properly

---

Testing checklist

• [ ] Contributor has fully tested the PR manually
• [ ] If there are any front-end changes, before/after screenshots are included
• [ ] Critical user journeys are covered by Gherkin stories
• [ ] Critical and brittle code paths are covered by unit tests

PR process

• [ ] PR has the correct target branch and milestone
• [ ] PR has 'needs review' or 'work-in-progress' label
• [ ] If PR is ready for review, a reviewer has been added. (Don't use 'Assignees')
• [ ] If this is an important user-facing change, PR or related issue has a 'changelog' label
• [ ] If this includes an internal dependency change, a link to the diff is provided

Reviewer checklist

• Automated test coverage is satisfactory
• PR is fully functional
• PR has been tested for accessibility regressions
• External dependency files were updated if necessary (yarn and pip)
• Documentation is updated
• Contributor is in AUTHORS.md

[github-actions[bot]]

Build Artifacts

Asset type	Download link
PEX file	kolibri-.pex
Windows Installer (EXE)	kolibri-0.17.0a0.dev0+git.141.ga2f67aed-windows-setup-unsigned.exe
Debian Package	kolibri_0.17.0a0.dev0+git.141.ga2f67aed-0ubuntu1_all.deb
Mac Installer (DMG)	kolibri-0.17.0a0.dev0+git.141.ga2f67aed-0.4.2.dmg
Android Package (APK)	kolibri-0.17.0a0.dev0+git.141.ga2f67aed-0.1.3-debug.apk
TAR file	kolibri-0.17.0a0.dev0+git.141.ga2f67aed.tar.gz
WHL file	kolibri-0.17.0a0.dev0+git.141.ga2f67aed-py2.py3-none-any.whl