If the state is null don't check for CSRF as well