Update rest.txt example to include headers required for CSRF

validation. Update config doc: X-Requested-With is used with rest as
well as xmlrpc.

Author: rouilj

doc/rest.txt

@@ -170,7 +170,8 @@ with a REST API supporting JSON encoding::
         ...     exit(1)
         >>> print (r.json() ['data']['data']
         TEST Title
-        >>> r = s.post (u + 'issue', data = dict (title = 'TEST Issue'))
+        >>> h = {'X-Requested-With': 'rest', 'Referer': 'http://tracker.example.com/demo/'}
+        >>> r = s.post (u + 'issue', data = dict (title = 'TEST Issue'), headers=h)
         >>> if not 200 <= r.status_code <= 201:
         ...     print("Failed: %s: %s" % (r.status_code, r.reason))
         ...     exit(1)
@@ -184,14 +185,19 @@ Retire/Restore::
         >>> print("ETag: %s" % etag)
         >>> etag = r.json()['data']['@etag']
         >>> print("@etag: %s" % etag)
-        >>> h = {'If-Match': etag}
+        >>> h = {'If-Match': etag, 'X-Requested-With': 'rest', 'Referer': 'http://tracker.example.com/demo/'}
         >>> d = {'@op:'action', '@action_name':'retire'}
         >>> r = s.patch(u + 'issue/42', data = d, headers = h)
         >>> print(r.json())
         >>> d = {'@op:'action', '@action_name':'restore'}
         >>> r = s.patch(u + 'issue/42', data = d, headers = h)
         >>> print(r.json())
 
+Note the addition of headers for: x-requested-with and referer. This
+allows the request to pass the CSRF protection mechanism. You may need
+to add Origin if this check is enabled in your tracker's config.ini.
+
+
 Adding new rest endpoints
 =========================
 

roundup/configuration.py

@@ -768,7 +768,7 @@ def str2value(self, value):
 Set this to 'no' to ignore the field and accept the post.
             """),
         (CsrfSettingOption, 'csrf_enforce_header_X-REQUESTED-WITH', "yes",
-            """This is only used for xmlrpc requests. This test is
+            """This is only used for xmlrpc and rest requests. This test is
 done after Origin and Referer headers are checked. It only
 verifies that the X-Requested-With header exists. The value
 is ignored.