Fix CSRF for reset key