Fix missing token check in require_csrf