!isset($_REQUEST["csrf"]) is extra fail cond