Fix: copy/paste facts not working with CSRF checks