Fix five confirmed bugs: typo, field name, auth, success message, debug print

- Fix `fist_name` typo in CSV bulk upload (first_name was always None)
- Fix CSV file field name mismatch: `members_data` → `csv_file` (matches form + template)
- Add `@login_required` to backend index view (was unprotected)
- Move `messages.success` inside `if form.is_valid()` (was always shown)
- Remove debug `print(response.headers)` from HTMXViewMixin

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/members/views.py

@@ -131,14 +131,14 @@ class MemberLoadView(PermissionRequiredMixin, HTMXViewMixin, SuccessMessageMixin
         return HttpResponseRedirect(reverse_lazy("backend:index"))
 
     def form_valid(self, form: MassUploadForm) -> HttpResponse:
-        member_data = self.request.FILES["members_data"]
+        member_data = self.request.FILES["csv_file"]
 
         with io.TextIOWrapper(member_data.file) as csvfile:
             reader = csv.reader(csvfile)
 
             for row in reader:
                 member_information = {"first_name": row[0], "last_name": row[1], "email": row[2], "birthday": row[3], "license": row[4]}
-                member = Member.create(first_name=member_information["fist_name"], last_name=member_information["last_name"], email=member_information["email"])
+                member = Member.create(first_name=member_information["first_name"], last_name=member_information["last_name"], email=member_information["email"])
 
                 member.license = member_information["license"]
                 if member_information["birthday"] is not None and member_information["birthday"] != "":