anchor.diff:                  <fmt:message key="user.create.invalid_name" />
               <% } else if (errors.get("email") != null) { %>
                   <fmt:message key="user.create.invalid_email" />
  +            <% } else if (errors.get("csrf") != null) { %>
  +                CSRF Failure!
               <% } %>
               </td>
           </tr>
  
positive.code:     String email = ParamUtils.getParameter(request,"email");
      boolean isAdmin = ParamUtils.getBooleanParameter(request,"isadmin");
      Map<String, String> errors = new HashMap<String, String>();
  
      // Handle a cancel
      if (request.getParameter("cancel") != null) {
          response.sendRedirect("user-properties.jsp?username=" + URLEncoder.encode(username, "UTF-8"));
          return;
      }
  
      // Load the user object
  
negative.code: 
  <%@ page import="org.jivesoftware.util.ParamUtils,
                   org.jivesoftware.util.StringUtils,
                   org.jivesoftware.util.CookieUtils,
                   org.jivesoftware.openfire.user.*,
                   java.net.URLEncoder"
      errorPage="error.jsp"
  