Merge pull request #3176 from caseyh/develop

CSRF whitelist supports regex