Fix CSRF vulnerability