Lebo&Sett: add csrf and fix deprecated named argument