GHSA-7XX3-QP5W-FW96 Cross-Site Request Forgery in JupyterHub

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...