Slowly adding CSRF support
Merge fix