Fix #436 Check for CSRF when request method is PATCH