Unsubscribe is CSRF exempt.

hc/front/views.py

@@ -701,6 +701,7 @@ def verify_email(request, code, token):
     return render(request, "bad_link.html")
 
 
+@csrf_exempt
 def unsubscribe_email(request, code, token):
     channel = get_object_or_404(Channel, code=code)
     if channel.make_token() != token:

templates/accounts/unsubscribe_submit.html

@@ -6,7 +6,6 @@
 <p>Please press the button below to unsubscribe:</p>
 <br />
 <form id="form" method="post">
-    {% csrf_token %}
     <input
         id="submit-btn"
         type="submit"