Fix CSRF in POST_use_item