main
security: require POST for org team and member actions (#8321)
refactor: drop the use of CSRF token entirely (#8300)
refactor(db): move some methods off `user.go` (#7199)