Fix CSRF validation