CSRF and post only protection for change ownership form