Backported fix for csrf disabled.