Another place missing csrf header.