WIP - implement CSRF context whitelist