Use clearer way to set up csrf protection