CSRF protection, cf issue #38