csrf defence
(cherry picked from commit 95b99af)