Up renderer and csrf