Add a word on URL-encoding CSRF tokens when needed