Cleaned up CSRF protection