CSRF protection updated