Why does Bandit depend on Plug?

[adamu]

@garrison

CSRF protection which is essentially no longer needed on the modern web

Could you elaborate what you mean by this?

For example, OWASP maintains an entire article and cheat sheet about CSRF prevention.