CLC-1636 QA branch version of CSRF security fixes

QA branch version of https://jira.media.berkeley.edu/jira/browse/CLC-1636 -- original pull is #927