Fixed a CSRF bug in the worst possible way