title: Do I need ValidateAntiForgeryToken on a Login action?
body: <p>It makes only some sense that this filter is, by default (i.e. by scaffolding) applied to the a <code>Login</code> action, as far as I know, this token works best when already associated with a login id. With it applied to <code>Login</code>, I have a problem if the user tries to log in twice, with an error such as</p>
  
  <blockquote>
    <p>The provided anti-forgery token was meant for user "", but the current
    user is "[theLoggedInUser]".</p>
  </blockquote>
  
  <p>Now a user logging in twice wouldn't normally be a problem, but for this, so the added effort of preventing this makes less sense, subject to answers to this question, than simply removing the validation from the login action.</p>