Don't rely on flask-csrf