CSRF protection. #361