A 401 for CSRF errors? Hmm, 401 Unauthorized sounds appropriate, but first time I'm seeing that used for CSRF.