Force SSL again.
Disable CSRF protection for POSTs.