only made the publication PUT command CSRF-protected

now new users can sign up again form Thimble.