Fix tests for new CSRF protections.