CSRF challenge on a file hosting service