Prevent CSRF; Ext. management