Send back the model (includes csrf) on bad token

Fix #1246