CSRF/XSS changes to 2.6.x