Allow CSRF for now