tickets: Use CSRF protection middleware.