fixes #1639
Merge pull request #1648 from xisi/unlock-csrf-fix

Fixes #1639