Updating to allow whitelisting of CSRF URLs