CSRF protection for admin pages only
Not added for all since that would add overhead to proxy