feed.py has to work, too
Revert "disable xsrf on forms"

This reverts commit 1a5d981d57063dc564c2dd934d43bbe5a2fde0ec.