SET-VIEWPORT-EVENT-HANDLER: CSRF checks added here too.