Prevent CSRF. Fixes #2