s3 swat: Add XSRF protection to status page