CSRF token is no longer an issue (actually)