use Input::param to check for a CSRF token, closes #1466