Security fix: ensure CSRF protection gets included.