I have some concern over the CSRFKey parameter. You can hardcode this?  The burp logs show they're always updated.

Thx.