Moved back to form login, but now with CSRF protection