Fix auth order to prevent request error and add CSRF