[EPIC] Invenio accounts CSRF and KVSession

[ppanero]

Cleanup

• SQLAlchemy-Utils dependency is migrated/inherited to invenio-db PR

CSRF

• Requires bumping Invenio-REST version
• PR Has been closed in favour of:
  • CSRF token reset
  • KVSession storage only for authenticated users

Test in Cookiecutter

• According to this issue

---

Current status: inveniosoftware/flask-kvsession#7

Potential cause of the issue:

• The configuration should not be set in cookiecutter:
  1. • Invenio-Accounts should be fixed to load configuration properly. Add SESSIONS_ and other potential prefixes (RECAPTCHA, check config.py) to config_apps list.
  2. • Cookiecutter PR should be closed

---

• Check suggestions from Lars here Side-effect while avoiding storing anonymous users sessions flask-kvsession#7 and test again.

update: Tests carried out by @Glignos seem to show that the problem is still not solved.

---

Release

• Make Invenio-Accounts v1.3.0 release.