[Web] Learning to XSRF [skip ci]