[invalid][false-positive] csrftoken on profile page

Summary

When testing csrf tokens on WakaTime's website, there are 2 ways we pass the csrf token in requests:

1. form post-data csrftoken, for HTML form submits
2. the X-CSRFToken header, for AJAX requests

The csrftoken cookie is only used to pass the token to JavaScript, it's not used for validating the request.

Closing this as not applicable since csrf tokens are working correctly.