CSRF + input validation (regex)