added CSRF protection for CMSimple_XH >= 1.6