CSRF meta tag setup at `Request` moved from `init()` to `resolve()`.