Fixed the POST, and removed the CSRF protection on anything not under /protect.