Relax CSRF constraint