Don't check CSRF token in InboxR, POSTs there freely come from other servers

src/Vervis/Foundation.hs

@@ -151,6 +151,7 @@ instance Yesod App where
                 handler
                 (getCurrentRoute >>= \ mr -> case mr of
                     Nothing                      -> return False
+                    Just InboxR                  -> return False
                     Just (GitUploadRequestR _ _) -> return False
                     Just r                       -> isWriteRequest r
                 )