Merge commit '4ad1c5aa7174e5cef4ba9608a44429916a119bee' into glitch-soc/merge-upstream

Conflicts:
- `README.md`:
  Upstream has updated their README, we have a completely different one.
  Kept ours.
- `config/initializers/content_security_policy.rb`:
  Upstream has updated their development CSPs, while we disable CSPs in
  the development environment.
  Kept our version.

config/environments/development.rb

@@ -35,6 +35,8 @@ Rails.application.configure do
     config.cache_store = :null_store
   end
 
+  config.action_controller.forgery_protection_origin_check = ENV['DISABLE_FORGERY_REQUEST_PROTECTION'].nil?
+
   ActiveSupport::Logger.new(STDOUT).tap do |logger|
     logger.formatter = config.log_formatter
     config.logger = ActiveSupport::TaggedLogging.new(logger)