Archived tweet #2137 from the @leastfixedpoint Twitter Archive

OH FFS :-( "JSON users: Avoid CSRFs by not using top-level arrays: http://flask.pocoo.org/docs/security/#json-security" (HT @SeanTAllen)