Closer to CSRF safety