Require auth on upload-token

atst/domain/auth.py

@@ -13,7 +13,6 @@ UNPROTECTED_ROUTES = [
     "atst.helpdocs",
     "static",
     "atst.about",
-    "atst.upload_token",
 ]
 
 

atst/routes/task_orders/new.py

@@ -4,7 +4,6 @@ from flask import (
     render_template,
     request as http_request,
     url_for,
-    current_app,
 )
 
 from . import task_orders_bp

js/components/upload_input.js

@@ -104,7 +104,7 @@ export default {
       this.sizeError = false
     },
     getUploader: async function() {
-      return fetch('/upload-token')
+      return fetch('/upload-token', { credentials: "include" })
         .then(response => response.json())
         .then(({ token }) => buildUploader(token))
     },