I don't know if the CSRF token thing is fixed entirely, but it's close.