text: Title: CGI Generic SQL Injection (blind)
  Body: If you'd like to report a bug in Flask-Appbuilder, fill out the template below. Provide
  any extra information that may be useful
  
  ### Environment
  
  Flask-Appbuilder version: `2.1.9`
  
  
  ### Describe the expected results
  
  I am using Superset with Flask-AppBuilder with version stated above. While doing some scanning using Nessus, found that problem on `login` page.
  
  
  ### Describe the actual results
  
  Tell us what happens instead.
  
  ```
  Using the POST HTTP method, Nessus found that :
  
  + The following resources may be vulnerable to blind SQL injection :
  
  + The 'csrf_token' parameter of the /login/ CGI :
  
  /login/ [username=&password=&csrf_token=ImQzYzFjYTZmMWQwMjMxNjcyMzQyOWI1
  NGUwYzU1MzYwNTAzZWQ0YjQi.XxqOfw.Rdt9Egs2sOALP63VUCR2zqBKg5Ezz&password=&
  csrf_token=ImQzYzFjYTZmMWQwMjMxNjcyMzQyOWI1NGUwYzU1MzYwNTAzZWQ0YjQi.XxqO
  fw.Rdt9Egs2sOALP63VUCR2zqBKg5Eyy]
  
  -------- output --------
  <title>400 Bad Request</title>
  <h1>Bad Request</h1>
  <p>The CSRF tokens do not match.</p>
  
  
  -------- vs --------
  <title>400 Bad Request</title>
  <h1>Bad Request</h1>
  <p>The CSRF token is invalid.</p>
  ------------------------
  ```
  
  ### Steps to reproduce
  
  