Added did_display logic + CSRF protection.