CONFIRMED: Jenkins 2.579 exposed a session crumb in dynamic Stapler JavaScript and accepted it for a protected POST; Jenkins 2.580 did not.