Invalid CSRF token

Implements part 1 of issue #493.