It is CSRF (Cross Site Request Forgery), not CSFR
Unset correct var
Do not return anything because it is misleading