CSRF shouldn't be in here, but… kick that one down the road