Fixing CSRF inclusion