CSRF and DTD disallow migrated in 2.10.x