Correct failing test for CSRF across scopes