Mitigate Flash CSRF issue

Fixes #356 for master.

Cherry-picked as 92b1c3c8c77dfb2acb2c274c894b3a6b8d4bd0d0 for 1.1.1.