CSRF better