Concerns: pushword/newsletter
The token GET /newsletter/form issues is signed with the app secret and carries its own expiry instead of living in the session, so it no longer needs a cookie sent back to be accepted. Concerns sites that set newsletter_csrf_protection: false because a static build is served from another domain: drop the line, it defaults to on. SubscribeForm::CSRF_TOKEN_ID is gone, and a front end posting the endpoint itself no longer carries the form response’s session cookie with the post.