Letting HEAD through the CSRF check.  And reusing variables to reduce function calls