Can't forget the CSRF, that'd be bad.