improved "do I need CSRF?"