Whitelist provider xls so it can be downloaded without authentication
Enable csrf protection
Merge branch 'csrf'