Fix csrf and auth entry points