Oops, fix bug in blanket CSRF