Added back CSRF check for GET/POST