Fixed cookies and decouples CSRF service