Fixed CSRF protection