s3 swat: Add XSRF protection to password page