Added state validation for CSRF.