Not sure how this ever worked, but we need to lift CSRF here