Add CSRF for first view
Simplfy iter and remove stray comment