This isn't using the new websocket CSRF stuff