Use valid CSRF protection with forms, get tests to pass again, implement lax (POST) 302 redirects.