https://github.com/openshift/origin/pull/1684

@jcantrill you'll need to add an "X-CSRF-Token" header (any value is allowed, it just has to be set) when making requests to /oauth/authorize with the openshift-challenging-client client_id.