CSRF protection of /link_accounts_request