Don't use CSRF on device activation
Remaining device work