Fix CSRF cookie

Should fix #2490.