Renamed csrfParam back to csrfVar for consistency.