Make requesting use POST only for CSRF