Fix CSRF handling + after sign in location