s3 swat: Add XSRF protection to wizard page