Added missing CSRF check