[REVIEW] csrf protection

Correct.