Security fix: CSRF, Parameter manipulation