Add missed CSRF check