Authentication token and CSRF token bypass

Summary

@whiteshadow201 was able to illustrate a vulnerability, due to an overzealous set of CORS rules, where they could execute certain functions on behalf of another user. This was made possible due to a separate vulnerability, a CSRF bypass, that was possible by using the GET method to query the GraphQL interface. In order to remedy the problem, we restricted the GraphQL interface to only accept traffic over POST (rather than both POST and GET) and we also restricted the scope of the CORS rules.