Move require of csrf-tokens