CSRF protection for oauth login links

[camallen]

When using oauth login links we have to be careful to avoid allowing activation of the oauth login process without ensuring the request originated by a known logged in user.

This is a recent exploit that was raised in rails land via omniauth/omniauth#809

A mitigation would be a CSRF validation via a POST method to the social auth routes before redirecting to the upstream social auth provider. Depending on what your application does with the upstream user data it may be a vector for account take over. I assume in this app it won't be, most likely changing the logged in user at worst but something to keep in mind with oauth flows.