Add force_login_param, csrf protection