CSRF fix

next: app.post to /workspaces