amadan
Docs: a carlos schedule tick hits rastrillo's CSRF check; show csrf.Exempt open
A carlos schedule tick is a POST with no Sec-Fetch-Site, Origin or Referer, so rastrillo's app-wide csrf.Protect refuses it with a 403. The platform's "Scheduled work" handler example only passes because it shows no CSRF middleware in front of it. Patrix hit this (Farshad's paid memberships branch works round it with exceptMachines).
Rastrillo now has the fix: csrf.Exempt(paths...), landed on main as 8fbde25:
r.Use(csrf.Protect(origin, csrf.Exempt("/jobs/sync")))
with the handler still guarded by carlos.Tick(r). Request: update the "Scheduled work" example (and anything else that shows a schedule handler) to mount it this way, and say why in a sentence. Released rastrillo tags will carry it from the next release.