WORD is identical to what was formerly clean_input_keys.  Since csrf is probably the most common thing we'll pull from here, HEX is useful for efficiency.