Signing into DocumentCloud throws a 403 CRSF error

[allanlasser]

• From www.documentcloud.org, click Sign In
• Enter credentials in Squarelet
• Redirect to application fails with message Forbidden (403): CSRF verification failed. Request aborted.

As a user, I don't know what to do next.

[allanlasser]

From what I can tell:

1. CRSF_TRUSTED_ORIGINS setting is populated by CRSF_TRUSTED_ORIGINS environment variable
2. This env variable is not set in Heroku

squarelet/config/settings/base.py

CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", default=[])

[mitchelljkotler]

I set the environment variable - let me know if this helps with the issue