Add form-action protection to the proxy.