Double slash in URLs causes CSRF issues

[aeneasr]

Describe the bug

Using a double-slash - usually on accident https://my-kratos//foo/bar - in URLs will cause the nosurf handler to ignore ExempPath which leads to hard to debug errors for API flows.

Reproducing the bug

Try to POST an API flow with a double slash in the URL to e.g. the password method.

Server logs

-encoding:gzip, deflate, br accept-language:en-us user-agent:Expo/2.17.4.101 CFNetwork/1197 Darwin/19.6.0 x-forwarded-for:2001:a61:1206:c401:c06f:dbf9:35e8:3e26 x-forwarded-proto:https] host:5a27986377c9.ngrok.io method:POST path://self-service/registration/methods/password query:flow=774b929f-5b38-493e-b956-17264136c7ec remote:172.19.0.1:43000 scheme:http] http_response=map[status_code:400] service_name=kratos service_version=
kratos_1                      | time=2020-10-20T06:58:10Z level=info msg=started handling request func=github.com/ory/x/reqlog.(*Middleware).ServeHTTP file=/go/pkg/mod/github.com/ory/x@v0.0.153/reqlog/middleware.go:131 method=POST name=public#http://127.0.0.1:4433/ remote=172.19.0.1:43000 request=//self-service/registration/methods/password?flow=774b929f-5b38-493e-b956-17264136c7ec
kratos_1                      | time=2020-10-20T06:58:10Z level=inf

Expected behavior

This should be handled gracefully.

Environment

• v0.5.1-alpha.1