Bug 20568: CSRF protection