Location detail page now sets CSRF cookie