Fix CSRF protection