Backporting the auto CSRF protection from 1.1 branch [keul]