Won't dropping the csrf token cause problems here?