Added CSRF paths