CSRF fix candidate