Fix wildcards.
Remove CSRF token.