Fix GitHub login broken by conditional CSRF tag

[david-a-wheeler]

We're trying to dramatically increase what the CDN caches. We're now fixing a problem we found while trying to do this.

The CDN-caching change (commit 9f8e5ae2) made csrf_meta_tags conditional on logged_in?, on the documented assumption that the only rails-ujs "method:" links live on logged-in pages.

However, that assumption was wrong: the login page's "Log in with GitHub" button is a link_to ... method: 'post', and rails-ujs reads the CSRF token from the meta tag. With the tag gone for anonymous users, the POST to /auth/github carried no token, OmniAuth rejected it with ActionController::InvalidAuthenticityToken, and login 404'd via /auth/failure.

This commit fixes the problem via the plan's own Section 9.1 opt-in escape hatch:

• Gate the layout tag on logged_in? || content_for?(:needs_csrf_meta).
• Have the login page (sessions/new) opt in. This is scoped to the login page, not the header's "Login" link (a plain GET link_to), so every other anonymous page stays cookie-free and CDN-cacheable; the never-cached login page is the sole, documented exception.

Also correct a subtle gotcha in the documented snippet: the block form content_for(:needs_csrf_meta) { true } does NOT work -- content_for captures the block's rendered output, and a block returning bare true outputs nothing, so content_for? stays false. The working form is the non-block content_for :needs_csrf_meta, 'true'. Fixed in code and docs.

Add a regression test that reproduces the production failure: it asserts the anonymous login page emits the CSRF meta tag, run WITH forgery protection enabled (it is disabled by default in the test env, which is why the original change shipped without catching this).

Also add script/verify_cdn_caching.sh, the staging/production verification harness used throughout this work (anonymous cacheable + no cookie, session and remember-me cookies bypass the cache, JSON still caches; --verbose dumps full headers). It exits non-zero on any failure, doubling as the periodic synthetic monitor recommended in Section 9.4.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (27bb73a) to head (67bc5a8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #2859   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           79        79           
  Lines         4331      4331           
=========================================
  Hits          4331      4331           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.