Issue #2348531: protect against CSRF