ported CSRF fix to 1.0 using sessions