CSRF fix suggestion