Fixes possible minor CSRF that potentially allowed attackers to
change a users language.

fixes #3733