Return a CSRF in case it's requested