Bring back the CSRF priority tests (not using API)