Whitelisted CSRF ignorance