Sign up works with CSRF