Consider making DefaultAntiforgery scoped instead of singleton

[HaoK]

This would let us get rid of the service locator antipattern...

-Microsoft.AspNetCore.Antiforgery\Internal\DefaultAntiforgery.cs:331:
var contextAccessor = services.GetRequiredService<IAntiforgeryContextAccessor>();

-Microsoft.AspNetCore.Antiforgery\Internal\DefaultAntiforgery.cs:441:
var contextAccessor = services.GetRequiredService<IAntiforgeryContextAccessor>();

https://github.com/aspnet/Coherence-Signed/issues/186

[rynowak]

Or, we can get rid of the context and use a feature, or HttpContext.Items.

This will have a cascading effect on MVC and cause a few filter implementations as well as bunch of HTML related infrastructure to become scoped. Scoped is really viral.

[rynowak]

Ran this by @lodejard and he likes the idea of a feature. The stuff that antiforgery puts in the context really is related to the current HttpRequest as a unit of work.

[lodejard]

Yep