CSRF and disabled cookies

[eluser]Treeda[/eluser]
Hi there,

i'm currently facing an issue if you have csrf enabled but the user has cookies disabled.

The problem is that you cannot react to that. The security class is grabbing and verifying before you even have the chance to do anything in your controller.

It's very bad to show an error message to the user like
"The action you have requested is not allowed."

it should more like something "hey, you need cookies enabled".

This could be done very easily with some kind of a callback to the controllers.