MiniOrange Authentication Module CSRF Fix

Maybe a feature request asking to add a hook there to allow non-core modules to alter the result?

Or a hook or another way exists to handle this specific case -- it should exist already. If so, it's a won't.

This was discussed in #bugsmash by myself, dww, jungle and larowlan. jungle has already added details. Finally, we all agreed that the status of this is won't fix.