Switch to session-based csrf form for manual use