Reverts to changeset 435, and just add {% csrf_token %} to template forgot_pw.html, since CSRF protection seems to be only here (surely because of django.contrib.auth.views).
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>All Classes - YUI AS Documentation</title>
<base target="classFrame">
<link rel="stylesheet" href="style.css" type="text/css" media="screen">
<link rel="stylesheet" href="print.css" type="text/css" media="print">
</head>
<body class="classFrameContent">
<h3>
<a style="color:black" target="classFrame" href="class-summary.html">All Classes</a>
</h3>
<table cellspacing="0" cellpadding="0">
<tr>
<td><a href="com/yui/util/io.html">io</a></td>
</tr>
</table>
</body>
</html>
<!-- -->