Forced login via unprotected static-credential callback

Login CSRF in 37signals Upright allows remote attackers to force an unauthenticated visitor into a session through the static-credentials callback. At the identified vulnerable commit, SessionsController#create skips Rails forgery protection and accepts that callback without requiring a POST or checking an authenticity token. The attack requires the visitor's browser to make an attacker-induced request while static-credential sign-in is in use; the session takes the identity accepted by the callback.