Add missing XCSRF code. Add db migration to spec file.