Move rule should have some CSRF protection