Bad with numbers.
Correctly apply CSRF protection.

  - Classes were used (in most cases) but the protection were not being
    applied at all.
Changelog.