Fix crypto payment cancellation

- Add CSRF token requirement to cancel endpoint for security
- Include CSRF token in crypto checkout template
- Add better error handling and debugging for cancel requests

make_post_sell/templates/crypto_checkout.j2

@@ -1,6 +1,7 @@
 {% extends "base.j2" -%}
 
 {% block content -%}
+{% include "snippets/csrf.j2" %}
 <section class="one-column">
   <h2>{{ coin_name }} ({{ coin_symbol }}) Checkout</h2>
 
@@ -239,7 +240,14 @@
             'X-CSRF-Token': document.querySelector('input[name="csrf_token"]') ? document.querySelector('input[name="csrf_token"]').value : ''
           }
         })
-        .then(response => response.json())
+        .then(response => {
+          console.log('Response status:', response.status);
+          console.log('Response headers:', response.headers);
+          if (!response.ok) {
+            throw new Error(`HTTP error! status: ${response.status}`);
+          }
+          return response.json();
+        })
         .then(data => {
           if (data.success) {
             alert('Payment quote cancelled successfully');

make_post_sell/views/crypto.py

@@ -694,7 +694,7 @@ def crypto_doge_status(request):
     )
 
 
-@view_config(route_name="crypto_cancel", request_method="POST")
+@view_config(route_name="crypto_cancel", request_method="POST", require_csrf=True)
 @user_required()
 def crypto_cancel(request):
     """Cancel a pending crypto payment."""