0d882eaca5
- Add CSRF token storage in sessionStorage (persists across reloads) - Send X-CSRF-Token header on POST/PATCH/DELETE requests - Store CSRF token on login, clear on logout - Fix trailing slash in mail list API call (/mail/ -> /mail)