Prevent CSRF attacks on settings page

Thanks, guido @ HackerOne!