Add the CSRF filter.
CSRF filter works; now remove it.