[feature flag] Enforce csrf protection on explore_json endpoint (#7935)

also added a section for featured flags in http://superset.incubator.apache.org/installation.html

superset/views/base.py

@@ -32,6 +32,7 @@ from flask_babel import gettext as __
 from flask_babel import lazy_gettext as _
 from flask_wtf.form import FlaskForm
 import simplejson as json
+from werkzeug.exceptions import HTTPException
 from wtforms.fields.core import Field, UnboundField
 import yaml
 
@@ -134,6 +135,13 @@ def handle_api_exception(f):
                 stacktrace=utils.get_stacktrace(),
                 status=e.status,
             )
+        except HTTPException as e:
+            logging.exception(e)
+            return json_error_response(
+                utils.error_msg_from_exception(e),
+                stacktrace=traceback.format_exc(),
+                status=e.code,
+            )
         except Exception as e:
             logging.exception(e)
             return json_error_response(