Apparently, also a missing CSRF token somewhere.

PS: Would it be possible to scan for those missing places automatically?