CSRF should use the variable