Fix bugs where CSRF attacks were still possible on some requests