Added missing CSRF checks