CSRF protection is mandatory now, and we have enabled it on our public site successfully, but as this previous answer notes, plain links (such as emailed URLs or bookmarks) to protected pages don't work. Instead they end up at our code 500 server-side error page, which is not the right message for the situation.
Is there a way to handle these links and get authenticated users to the right pages?
If not, what is the right way to handle these external links?
