Back to regexp matching because glob can't be rooted.
Add csrf to legacy/user.js.