@Changaco Why did we change where `csrf_token` is taken from?