Still debugging CSRF in pagodabox