CSRF protect admin.php (thx daeken)