Bug fix: CSRF cookies