CSRF compatibility.

see #240
Don't forget gif files...