A lot of fixing to the CSRF stuff to make it better.