Clearly limit new CSRF protection to GET requests