Don't submit form if the user has cancelled the confirmation request
Also send CSRF token for requests triggered from links