Fix incorrect url encoding
Prevent xsrf