Substitute CSRF checking for ROMANCARTXML feedback in '/cart/completed'