I have found what seems to be a nasty bug in my Django site. The login form uses {% csrf_token %} and also I set <meta name=referrer content=same-origin>. This login page works fine. However I noticed by chance that if the CSRF token or the referer are not sent, the site logs this error, sends me an email but still lets me in. I can reproduce it with python-requests or with Chrome's Servistate HTTP Editor & REST API client extension---but for some reason not with cURL command line tool, for which access seems to be blocked correctly. I am lost in how to debug it, and would really appreciate any hints.
How can I check Django's CSRF and Referer protection?
django;debug