CSRF comments and stuff