Re-enabled CSRF protection for Policies and Divisions; fixes #445.