Add CSRF protection.
Fix wrong function name.