Rename CSRF dodging & make sure page text is embeddable.