WIP: CSRF protection, failing tests