CSRF check for approve and decline user flows