CSRF and mysqli fixes