SECURITY: correct our CSRF implementation to be much more aggressive