Bug 819361, fix up csrf handling, r=rail