Fix csrf blackhole