feat: Enhance security by adding @login_required to multiple views and replacing print statements with logger.debug

Co-authored-by: Copilot <copilot@github.com>

atlas/views.py

@@ -1587,7 +1587,7 @@ def condition_merge(request, pk_to_merge):
     condition_to_merge = get_object_or_404(Condition, pk=pk_to_merge)
     # condition_to_merge_into = get_object_or_404(Condition, pk=pk_to_merge_into)
 
-    print(condition_to_merge.case_set)
+    logger.debug("condition_merge: case_set={}", condition_to_merge.case_set)
     if condition_to_merge.rcr_curriculum:
         return HttpResponse("You cannot merge rcr curriculum items")
 
@@ -2081,7 +2081,7 @@ def add_case_to_collection(request, collection_id):
         if case in collection.cases.all():
             return HttpResponse("Case already in collection")
 
-        print(case)
+        logger.debug("collection_add_case: case={}", case)
         collection.add_case(case)
         # Render the new case list item and return it so HTMX can append it
         try:
@@ -3215,10 +3215,16 @@ def atlas_scrap(request, pk):
 #     return render(request, "atlas/create_simple.html", {'form': form})
 
 
-@csrf_exempt
+@login_required
 def get_examination_id(request):
-    if request.accepts("application/json")():
-        examination_name = request.GET["examination_name"]
+    """Return the primary key for an Examination looked up by name (admin popup helper).
+
+    Scope: authenticated users only.
+    Functionality: looks up an Examination by exact name and returns its ID as JSON;
+    used by inline admin form popups.
+    """
+    if request.accepts("application/json"):
+        examination_name = request.GET.get("examination_name", "")
         examination_id = Examination.objects.get(name=examination_name).id
         data = {
             "examination_id": examination_id,
@@ -7916,7 +7922,6 @@ def series_bulk_delete(request):
     return redirect('atlas:series_view')
 
 @user_is_collection_author_or_atlas_editor
-@csrf_exempt  # Only if you have CSRF issues; otherwise, keep CSRF protection
 def collection_case_displaysetup(request, collection_id, case_number=None, case_id=None):
     """
     View to set up the display options for a specific case in a collection.