anchor.diff:              return;
           }
       }
  +
  +    csrfParam = StringUtils.randomString(15);
  +    CookieUtils.setCookie(request, response, "csrf", csrfParam, -1);
   %>
   
   <html>
  
positive.code: 
  <%@ page import="org.jivesoftware.util.ParamUtils,
                   org.jivesoftware.util.StringUtils,
                   org.jivesoftware.openfire.user.*,
                   java.net.URLEncoder"
      errorPage="error.jsp"
  
negative.code:     String email = ParamUtils.getParameter(request,"email");
      boolean isAdmin = ParamUtils.getBooleanParameter(request,"isadmin");
      Map<String, String> errors = new HashMap<String, String>();
      Cookie csrfCookie = CookieUtils.getCookie(request, "csrf");
      String csrfParam = ParamUtils.getParameter(request, "csrf");
  
      // Handle a cancel
      if (request.getParameter("cancel") != null) {
          response.sendRedirect("user-properties.jsp?username=" + URLEncoder.encode(username, "UTF-8"));
          return;
      }
  
      if (save) {
          if (csrfCookie == null || csrfParam == null || !csrfCookie.getValue().equals(csrfParam)) {
              save = false;
              errors.put("csrf", "CSRF Failure");
          }
      }
  
      // Load the user object
  