Should it also have @ensure_csrf_cookie?