Move csrf handler to frontend_misc.py.