XSRF fixes