Replaced hard-coded urls
CSRF fixes