FIX: csrf for scripts.
0.4.5