Issue #246 - CSRF is now per-session not per-request