Handle CSRF protection outside of forms