Merged csrf patch from master.