DE776 - changed CSRF from session to cookie.