Added missing protection against CSRF