Improved CSRF protection