Report unsubscribe link works with POST. Include "X-Bounce-Url" header in report emails.

hc/accounts/models.py

@@ -152,7 +152,11 @@ class Profile(models.Model):
 
         unsub_url = self.reports_unsub_url()
 
-        headers = {"List-Unsubscribe": unsub_url}
+        headers = {
+            "List-Unsubscribe": unsub_url,
+            "X-Bounce-Url": unsub_url
+        }
+
         ctx = {
             "checks": checks,
             "sort": self.sort,

hc/accounts/views.py

@@ -13,6 +13,7 @@ from django.core import signing
 from django.http import HttpResponseForbidden, HttpResponseBadRequest
 from django.shortcuts import redirect, render
 from django.utils.timezone import now
+from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_POST
 from hc.accounts.forms import (ChangeEmailForm, EmailPasswordForm,
                                InviteTeamMemberForm, RemoveTeamMemberForm,
@@ -344,6 +345,7 @@ def change_email_done(request):
     return render(request, "accounts/change_email_done.html")
 
 
+@csrf_exempt
 def unsubscribe_reports(request, username):
     signer = signing.TimestampSigner(salt="reports")
     try: