@Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
    {
        doCommon(request, response);

        final String csrfParam = StringUtils.randomString(15);
        CookieUtils.setCookie(request, response, "csrf", csrfParam, -1);
        request.setAttribute("csrf", csrfParam);

        request.getRequestDispatcher("plugin-admin-jsp.jsp").forward(request, response);
    }
Defines the expected content-type of uploaded plugin files.
xmppserver/src/main/java/org/jivesoftware/admin/servlet/PluginServlet.java