CSRF is go