Refined urltokens and XSRF protection