Backporting CSRF fix from 1.1 branch