Let whitelisted pages generate CSRF tokens

Should fix #933.