Add CSRF + remove unnecessary route