I would change this to:

> and then soft-deployed it -- silently reporting CSRF failures to a database.