adding enhanced csrf protection

app-code/api/login/set_username.php

@@ -2,6 +2,10 @@
 include "../utils/security.php";
 secure_session_start();
 require_same_origin_request();
+require_csrf_token();
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+	json_response(['success' => false, 'message' => 'Invalid request method.'], 405);
+}
 $_SESSION["needs_auth"]=true;
 $_SESSION["logged_in"]=false;
 $username = strtolower((string) ($_POST["username"] ?? ""));