Guest voucher uploads via the API

[multimeric]

The API supports guest uploads, via the vid parameter: https://docs.filesender.org/filesender/v2.0/rest/#guest-token. However, the API still checks the security tokens (Csrftoken and X-Filesender-Security-Token) for guest requests, which the user can't obtain using the API. Failing to provide these gives rest_xsrf_token_did_not_match.

Considering this, I wonder how it might be possible to support an API-only workflow for guest uploading?

[monkeyiq]

The API calls are made with AuthRemote being the authentication on the server side. We could either allow these security tokens to be read from the server or disable the checking of them for AuthRemote requests. It probably makes most sense to use Auth::isRemote() to allow both native REST calls and remote applications to avoid the xsrf checks.

[multimeric]

I would have thought that all API requests that request a token, including a guest token, should not check CSRF. But then I'm no security expert.