[WIP] Move CSRF check

Fixes a regression in master. - **DO NOT MERGE**