diff --git a/web/concrete/controllers/single_page/dashboard/pages/themes.php b/web/concrete/controllers/single_page/dashboard/pages/themes.php
index 19184c7f34d..8686721d2df 100644
--- a/web/concrete/controllers/single_page/dashboard/pages/themes.php
+++ b/web/concrete/controllers/single_page/dashboard/pages/themes.php
@@ -33,13 +33,18 @@ public function view() {
 	}
 
 	public function save_mobile_theme() {
-		$pt = PageTheme::getByID($this->post('MOBILE_THEME_ID'));
-		if (is_object($pt)) {
-			Config::save('concrete.misc.mobile_theme_id', $pt->getThemeID());
+		if ($this->token->validate('save_mobile_theme')) {
+			$pt = PageTheme::getByID($this->post('MOBILE_THEME_ID'));
+			if (is_object($pt)) {
+				Config::save('concrete.misc.mobile_theme_id', $pt->getThemeID());
+			} else {
+				Config::save('concrete.misc.mobile_theme_id', 0);
+			}
+			$this->redirect('/dashboard/pages/themes', 'mobile_theme_saved');
 		} else {
-			Config::save('concrete.misc.mobile_theme_id', 0);
+			$this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+			$this->view();
 		}
-		$this->redirect('/dashboard/pages/themes', 'mobile_theme_saved');
 	}
 
 	public function mobile_theme_saved() {
diff --git a/web/concrete/controllers/single_page/dashboard/system/attributes/types.php b/web/concrete/controllers/single_page/dashboard/system/attributes/types.php
index b9ec288dae9..c0bb0cec830 100644
--- a/web/concrete/controllers/single_page/dashboard/system/attributes/types.php
+++ b/web/concrete/controllers/single_page/dashboard/system/attributes/types.php
@@ -9,7 +9,7 @@
 use Loader;
 
 class Types extends DashboardPageController {
-	
+
 	public function add_attribute_type() {
 		$pat = PendingType::getByHandle($this->post('atHandle'));
 		if (is_object($pat)) {
@@ -19,18 +19,22 @@ public function add_attribute_type() {
 	}
 
 	public function save_attribute_type_associations() {
-		$list = Category::getList();
-		foreach($list as $cat) {
-			$cat->clearAttributeKeyCategoryTypes();
-			if (is_array($this->post($cat->getAttributeKeyCategoryHandle()))) {
-				foreach($this->post($cat->getAttributeKeyCategoryHandle()) as $id) {
-					$type = Type::getByID($id);
-					$cat->associateAttributeKeyType($type);
-				}
-			}
-		}
+        if ($this->token->validate('save_attribute_type_associations')) {
+            $list = Category::getList();
+            foreach ($list as $cat) {
+                $cat->clearAttributeKeyCategoryTypes();
+                if (is_array($this->post($cat->getAttributeKeyCategoryHandle()))) {
+                    foreach ($this->post($cat->getAttributeKeyCategoryHandle()) as $id) {
+                        $type = Type::getByID($id);
+                        $cat->associateAttributeKeyType($type);
+                    }
+                }
+            }
 
-		$this->redirect('dashboard/system/attributes/types', 'saved', 'associations_updated');
+            $this->redirect('dashboard/system/attributes/types', 'saved', 'associations_updated');
+        } else {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+        }
 	}
 
 	public function saved($mode = false) {
@@ -46,5 +50,5 @@ public function saved($mode = false) {
 			}
 		}
 	}
-	
-}
\ No newline at end of file
+
+}
diff --git a/web/concrete/controllers/single_page/dashboard/system/basics/accessibility.php b/web/concrete/controllers/single_page/dashboard/system/basics/accessibility.php
index f2854ec3f0b..ae28812117a 100644
--- a/web/concrete/controllers/single_page/dashboard/system/basics/accessibility.php
+++ b/web/concrete/controllers/single_page/dashboard/system/basics/accessibility.php
@@ -23,6 +23,10 @@ public function saved()
 
     public function save()
     {
+        if (!$this->token->validate('accessibility')) {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+            return $this->view();
+        }
         Config::save('concrete.accessibility.toolbar_titles', !!Request::post('show_titles', false));
         Config::save('concrete.accessibility.toolbar_large_font', !!Request::post('increase_font_size', false));
         Config::save('concrete.accessibility.display_help_system', !!Request::post('display_help', false));
diff --git a/web/concrete/controllers/single_page/dashboard/system/conversations/points.php b/web/concrete/controllers/single_page/dashboard/system/conversations/points.php
index 22a023a9720..3860d0f80bf 100644
--- a/web/concrete/controllers/single_page/dashboard/system/conversations/points.php
+++ b/web/concrete/controllers/single_page/dashboard/system/conversations/points.php
@@ -16,14 +16,22 @@ public function success() {
         $this->set('message', t('Rating types updated.'));
     }
     public function save() {
-        $db = Loader::db();
-        foreach (ConversationRatingType::getList() as $crt) {
-            $rtID = $crt->getConversationRatingTypeID();
-            $rtPoints = $this->post('rtPoints_' . $rtID);
-            if (is_string($rtPoints) && is_numeric($rtPoints)) {
-                $db->Execute('UPDATE ConversationRatingTypes SET cnvRatingTypeCommunityPoints = ? WHERE cnvRatingTypeID = ? LIMIT 1', array($rtPoints, $rtID));
+
+        if ($this->token->validate('conversation_points')) {
+
+            $db = Loader::db();
+            foreach (ConversationRatingType::getList() as $crt) {
+                $rtID = $crt->getConversationRatingTypeID();
+                $rtPoints = $this->post('rtPoints_' . $rtID);
+                if (is_string($rtPoints) && is_numeric($rtPoints)) {
+                    $db->Execute('UPDATE ConversationRatingTypes SET cnvRatingTypeCommunityPoints = ? WHERE cnvRatingTypeID = ? LIMIT 1',
+                        array($rtPoints, $rtID));
+                }
             }
+            $this->redirect('/dashboard/system/conversations/points', 'success');
+        } else {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+            $this->view();
         }
-        $this->redirect('/dashboard/system/conversations/points', 'success');
     }
 }
diff --git a/web/concrete/controllers/single_page/dashboard/system/optimization/jobs.php b/web/concrete/controllers/single_page/dashboard/system/optimization/jobs.php
index 7244902cb16..4f1c8a0aa79 100644
--- a/web/concrete/controllers/single_page/dashboard/system/optimization/jobs.php
+++ b/web/concrete/controllers/single_page/dashboard/system/optimization/jobs.php
@@ -9,7 +9,7 @@
 
 class Jobs extends DashboardPageController {
 
-	function on_start() 
+	function on_start()
 	{
 		parent::on_start();
 		// clear the environment overrides cache first
@@ -17,25 +17,25 @@ function on_start()
 		$env->clearOverrideCache();
 
 		$installed = Job::getList();
-		$this->set('availableJobs', Job::getAvailableList(0)); 
-		$this->set('installedJobs', $installed); 
+		$this->set('availableJobs', Job::getAvailableList(0));
+		$this->set('installedJobs', $installed);
 		$this->set('jobSets', JobSet::getList());
 		$this->set('auth', Job::generateAuth());
 	}
 
-	public function view() 
+	public function view()
 	{
 		$this->set('jobListSelected', true);
 	}
-	
-	public function view_sets() 
+
+	public function view_sets()
 	{
 		$this->set('jobSetsSelected', true);
 	}
 
-	function install($handle = null) 
+	function install($handle = null)
 	{
-		if ($handle) 
+		if ($handle)
 		{
 			Job::installByHandle($handle);
 			$this->redirect('/dashboard/system/optimization/jobs', 'job_installed');
@@ -44,65 +44,70 @@ function install($handle = null)
 		}
 		$this->view();
 	}
-	
-	function uninstall($job_id = null) 
+
+	function uninstall($job_id = null, $token = null)
 	{
-		if ($job_id) 
-		{	
-			$job = Job::getByID((int) $job_id);
-			if ($job) 
-			{
-				if (!$job->jNotUninstallable) 
-				{
-					$job->uninstall();
-					$this->redirect('/dashboard/system/optimization/jobs', 'job_uninstalled');
-				} else {
-					$this->error->add(t('This job cannot be uninstalled.'));
-				}
-			} else {
-				$this->error->add(t('Job not found.'));
-			}
-		} else {
-			$this->error->add(t('No job specified.'));
-		}
+	    if ($this->token->validate('uninstall_job', $token)) {
+            if ($job_id) {
+                $job = Job::getByID((int)$job_id);
+                if ($job) {
+                    if (!$job->jNotUninstallable) {
+                        $job->uninstall();
+                        $this->redirect('/dashboard/system/optimization/jobs', 'job_uninstalled');
+                    } else {
+                        $this->error->add(t('This job cannot be uninstalled.'));
+                    }
+                } else {
+                    $this->error->add(t('Job not found.'));
+                }
+            } else {
+                $this->error->add(t('No job specified.'));
+            }
+        } else {
+            $this->error->add(t('Invalid CSRF Token.'));
+        }
 		$this->view();
 	}
 
-	public function job_uninstalled() 
+	public function job_uninstalled()
 	{
 		$this->set('message', t('Job successfully uninstalled.'));
 		$this->view();
 	}
 
-	public function job_installed() 
+	public function job_installed()
 	{
 		$this->set('message', t('Job successfully installed.'));
 		$this->view();
 	}
-	
-	public function reset() 
+
+	public function reset($token='')
 	{
+	    if (!$this->token->validate('reset_jobs', $token)) {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+            return $this->view();
+        }
 		$jobs = Job::getList();
-		foreach($jobs as $j) 
+		foreach($jobs as $j)
 		{
 			$j->reset();
 		}
 		$this->redirect('/dashboard/system/optimization/jobs', 'reset_complete');
 	}
 
-	public function reset_complete() 
+	public function reset_complete()
 	{
 		$this->set('message', t('All running jobs have been reset.'));
 		$this->view();
 	}
 
-	public function set_added() 
+	public function set_added()
 	{
 		$this->set('success', t('Job set added.'));
 		$this->set('jobSetsSelected', true);
 	}
 
-	public function edit_set($jsID = false) 
+	public function edit_set($jsID = false)
 	{
 		$this->set('jobSetsSelected', true);
 		$js = JobSet::getByID($jsID);
@@ -113,164 +118,174 @@ public function edit_set($jsID = false)
 		}
 	}
 
-	public function update_set_jobs() 
+	public function update_set_jobs()
 	{
-		if ($this->token->validate('update_set_jobs')) 
-		{ 
+		if ($this->token->validate('update_set_jobs'))
+		{
 			$js = JobSet::getByID($this->post('jsID'));
-			if (!is_object($js)) 
+			if (!is_object($js))
 			{
 				$this->error->add(t('Invalid Job set.'));
 			}
 
-			if (!$this->error->has()) 
+			if (!$this->error->has())
 			{
 				// go through and add all the attributes that aren't in another set
 				$js->clearJobs();
-				if (is_array($this->post('jID'))) 
+				if (is_array($this->post('jID')))
 				{
-					foreach($_POST['jID'] as $jID) 
+					foreach($_POST['jID'] as $jID)
 					{
 						$j = Job::getByID($jID);
-						if(is_object($j)) 
+						if(is_object($j))
 						{
 							$js->addJob($j);
 						}
-					}					
+					}
 				}
 				$this->redirect('/dashboard/system/optimization/jobs', 'set_updated');
-			}	
-			
+			}
+
 		} else {
 			$this->error->add($this->token->getErrorMessage());
 		}
 		$this->edit($this->post('asID'));
 	}
-	
-	public function set_updated() 
+
+	public function set_updated()
 	{
 		$this->set('jobSetsSelected', true);
 		$this->set('success', t('Job Set updated successfully.'));
 	}
 
-	public function update_set() 
+	public function update_set()
 	{
 		$this->set('jobSetsSelected', true);
-		if ($this->token->validate('update_set')) 
-		{ 
+		if ($this->token->validate('update_set'))
+		{
 			$js = JobSet::getByID($this->post('jsID'));
-			if (!is_object($js)) 
+			if (!is_object($js))
 			{
 				$this->error->add(t('Invalid Job set.'));
 			} else {
-				if (!trim($this->post('jsName'))) 
-				{ 
+				if (!trim($this->post('jsName')))
+				{
 					$this->error->add(t("Specify a name for your Job set."));
 				}
 			}
-			
-			if (!$this->error->has()) 
+
+			if (!$this->error->has())
 			{
 				$js->updateJobSetName($this->post('jsName'));
 				$this->redirect('/dashboard/system/optimization/jobs', 'set_updated');
 			}
-			
+
 		} else {
 			$this->error->add($this->token->getErrorMessage());
 		}
 	}
 
-	public function set_deleted() 
+	public function set_deleted()
 	{
 		$this->set('jobSetsSelected', true);
 		$this->set('success', t('Group set deleted successfully.'));
 	}
 
-	public function delete_set() 
+	public function delete_set()
 	{
 		$this->set('jobSetsSelected', true);
-		if ($this->token->validate('delete_set')) 
-		{ 
+		if ($this->token->validate('delete_set'))
+		{
 			$js = JobSet::getByID($this->post('jsID'));
-			if (!$js->canDelete()) 
+			if (!$js->canDelete())
 			{
 				$this->error->add(t('You cannot delete the default Job set.'));
 			}
 
-			if (!is_object($js)) 
+			if (!is_object($js))
 			{
 				$this->error->add(t('Invalid Job set.'));
 			}
-			
-			if (!$this->error->has()) 
+
+			if (!$this->error->has())
 			{
 				$js->delete();
 				$this->redirect('/dashboard/system/optimization/jobs', 'set_deleted');
-			}			
+			}
 			$this->edit_set($this->post('jsID'));
 		} else {
 			$this->error->add($this->token->getErrorMessage());
 		}
 	}
 
-	public function add_set() 
+	public function add_set()
 	{
 		$this->set('jobSetsSelected', true);
-		if ($this->token->validate('add_set')) { 
-			if (!trim($this->post('jsName'))) 
-			{ 
+		if ($this->token->validate('add_set')) {
+			if (!trim($this->post('jsName')))
+			{
 				$this->error->add(t("Specify a name for your Job set."));
 			}
-			
-			if (!$this->error->has()) 
-			{			
+
+			if (!$this->error->has())
+			{
 				$js = JobSet::add($this->post('jsName'));
-				if (is_array($_POST['jID'])) 
+				if (is_array($_POST['jID']))
 				{
-					foreach($_POST['jID'] as $jID) 
+					foreach($_POST['jID'] as $jID)
 					{
 						$j = Job::getByID($jID);
-						if(is_object($j)) 
+						if(is_object($j))
 						{
 							$js->addJob($j);
 						}
-					}					
+					}
 				}
 				$this->redirect('/dashboard/system/optimization/jobs', 'set_added');
 			}
-			
+
 		} else {
 			$this->error->add($this->token->getErrorMessage());
 		}
 	}
 
-	public function update_job_schedule() 
+	public function update_job_schedule()
 	{
-		$jID = $this->request->request->get('jID');
-		$J = Job::getByID($jID);
-		$J->setSchedule($this->post('isScheduled'), $this->post('unit'), max(0,(int)$this->post('value')));
-		$this->redirect('/dashboard/system/optimization/jobs', 'job_scheduled');
+	    if ($this->token->validate('update_job_schedule')) {
+            $jID = $this->request->request->get('jID');
+            $J = Job::getByID($jID);
+            $J->setSchedule($this->post('isScheduled'), $this->post('unit'), max(0, (int)$this->post('value')));
+            $this->redirect('/dashboard/system/optimization/jobs', 'job_scheduled');
+        } else {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+            $this->view();
+        }
 	}
-	
-	public function job_scheduled() 
+
+	public function job_scheduled()
 	{
 		$this->set('success', t('Job schedule updated successfully.'));
 		$this->view();
 	}
-	
-	
-	public function update_set_schedule() 
+
+
+	public function update_set_schedule()
 	{
-		$jsID = $this->post('jsID');
-		$S = JobSet::getByID($jsID);
-		$S->setSchedule($this->post('isScheduled'), $this->post('unit'), $this->post('value'));
-		
-		$this->redirect('/dashboard/system/optimization/jobs', 'set_scheduled');
+        if ($this->token->validate('update_set_schedule')) {
+            $jsID = $this->post('jsID');
+            $S = JobSet::getByID($jsID);
+            $S->setSchedule($this->post('isScheduled'), $this->post('unit'), $this->post('value'));
+
+            $this->redirect('/dashboard/system/optimization/jobs', 'set_scheduled');
+        } else {
+            $this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
+            $this->view();
+        }
 	}
-	
-	public function set_scheduled() 
+
+	public function set_scheduled()
 	{
 		$this->set('success', t('Job Set schedule updated successfully.'));
 		$this->view();
 	}
-}
\ No newline at end of file
+}
diff --git a/web/concrete/controllers/single_page/dashboard/system/seo/bulk.php b/web/concrete/controllers/single_page/dashboard/system/seo/bulk.php
index 5f975737322..4615c843312 100644
--- a/web/concrete/controllers/single_page/dashboard/system/seo/bulk.php
+++ b/web/concrete/controllers/single_page/dashboard/system/seo/bulk.php
@@ -88,9 +88,15 @@ public function view()
 
     public function saveRecord()
     {
+        $cID = $this->post('cID');
+
+        if (!$this->token->validate('save_seo_record_' . $cID)) {
+            $error = t('Invalid CSRF token. Please refresh and try again.');
+            return JsonResponse::create(array('message' => $error));
+        }
+
         $text = $this->app->make('helper/text');
         $success = t('success');
-        $cID = $this->post('cID');
         $c = Page::getByID($cID);
         if (!$c || $c->isError()) {
             throw new \RuntimeException(t('Unable to find the specified page'));
diff --git a/web/concrete/single_pages/dashboard/pages/themes/view.php b/web/concrete/single_pages/dashboard/pages/themes/view.php
index 062ff3a8137..ad9e54ae831 100644
--- a/web/concrete/single_pages/dashboard/pages/themes/view.php
+++ b/web/concrete/single_pages/dashboard/pages/themes/view.php
@@ -66,6 +66,9 @@
         }
     ?></table>
     <form method="post" action="<?=$view->action('save_mobile_theme')?>" class="form-inline">
+        <?php
+        $valt->output('save_mobile_theme');
+        ?>
         <h3><?=t('Mobile Theme')?></h3>
         <p><?=t('To use a separate theme for mobile browsers, specify it below.')?></p>
         <div class="control-group">
diff --git a/web/concrete/single_pages/dashboard/system/attributes/types.php b/web/concrete/single_pages/dashboard/system/attributes/types.php
index 6b5baeaf05a..ac950c28b5a 100644
--- a/web/concrete/single_pages/dashboard/system/attributes/types.php
+++ b/web/concrete/single_pages/dashboard/system/attributes/types.php
@@ -7,9 +7,11 @@
 $txt = Loader::helper('text');
 $form = Loader::helper('form');
 $interface = Loader::helper('concrete/ui');
+$valt = Core::make('token');
 
 echo Loader::helper('concrete/dashboard')->getDashboardPaneHeaderWrapper(t('Attribute Type Associations'), false, 'span10 offset1');?>
 <form method="post" class="" id="attribute_type_associations_form" action="<?=$view->action('save_attribute_type_associations')?>">
+	<?php $valt->output('save_attribute_type_associations'); ?>
 	<table border="0" cellspacing="1" cellpadding="0" border="0" class="table">
 		<tr>
 			<th><?=t('Name')?></th>
@@ -66,4 +68,4 @@
 
 <? } ?>
 
-<?php echo Loader::helper('concrete/dashboard')->getDashboardPaneFooterWrapper(false);
\ No newline at end of file
+<?php echo Loader::helper('concrete/dashboard')->getDashboardPaneFooterWrapper(false);
diff --git a/web/concrete/single_pages/dashboard/system/basics/accessibility.php b/web/concrete/single_pages/dashboard/system/basics/accessibility.php
index 405277ea5f7..303534a834a 100644
--- a/web/concrete/single_pages/dashboard/system/basics/accessibility.php
+++ b/web/concrete/single_pages/dashboard/system/basics/accessibility.php
@@ -1,4 +1,7 @@
 <form action="<?= View::action('save') ?>" method="post">
+    <?php
+    Core::make('token')->output('accessibility');
+    ?>
     <div class="checkbox">
         <label>
             <input name="show_titles" value="1" type="checkbox" <?= $show_titles ? 'checked' : '' ?> />
diff --git a/web/concrete/single_pages/dashboard/system/conversations/points.php b/web/concrete/single_pages/dashboard/system/conversations/points.php
index b4253390d3c..71e4a5ca6f4 100644
--- a/web/concrete/single_pages/dashboard/system/conversations/points.php
+++ b/web/concrete/single_pages/dashboard/system/conversations/points.php
@@ -1,9 +1,11 @@
 <?php defined('C5_EXECUTE') or die("Access Denied.");
 $form = Loader::helper('form');
+$token = Core::make('token');
 ?>
 <h4><?=t('Installed Rating Types')?></h4>
 <? if (count($ratingTypes) > 0) { ?>
     <form action="<?=$view->action('save')?>" method="post">
+        <?php $token->output('conversation_points') ?>
         <table class="table">
             <thead>
             <tr>
diff --git a/web/concrete/single_pages/dashboard/system/optimization/jobs.php b/web/concrete/single_pages/dashboard/system/optimization/jobs.php
index b775de979b8..ab40ffe83bf 100644
--- a/web/concrete/single_pages/dashboard/system/optimization/jobs.php
+++ b/web/concrete/single_pages/dashboard/system/optimization/jobs.php
@@ -5,6 +5,9 @@
 /* @var $dh \Concrete\Core\Localization\Service\Date */
 $dh = Core::make('helper/date');
 
+$token = Core::make('token');
+$uninstallToken = $token->generate('uninstall_job');
+
 ?>
 <style type="text/css">
 #ccm-jobs-list td {
@@ -53,22 +56,22 @@
     		<th style="width: 250px"><?=t('Name')?></th>
     		<th><?=t('Last Run')?></th>
     		<th style="width: 200px"><?=t('Results of Last Run')?></th>
-    		<th><a href="<?=$view->action('reset')?>" class="btn btn-default pull-right btn-xs"><?=t('Reset All Jobs')?></a></th>
+    		<th><a href="<?=$view->action('reset', $token->generate('reset_jobs'))?>" class="btn btn-default pull-right btn-xs"><?=t('Reset All Jobs')?></a></th>
     		<th></th>
     	</tr>
 	</thead>
-	
+
 	<tbody>
     	<? foreach($installedJobs as $j) { ?>
     		<tr class="<? if ($j->didFail()) { ?>error<? } ?> <? if ($j->getJobStatus() == 'RUNNING') {?>running<? } ?>">
     			<td>
     			    <?=$j->getJobID()?>
                 </td>
-                
+
     			<td>
     			    <i class="fa fa-question-circle launch-tooltip" title="<?=$j->getJobDescription()?>"></i> <?=$j->getJobName()?>
                 </td>
-                
+
     			<td class="jDateLastRun"><?
     				if ($j->getJobStatus() == 'RUNNING') {
     					$runtime = $dh->formatDateTime($j->getJobDateLastRun(), true, true);
@@ -82,22 +85,22 @@
     					echo $runtime;
     				}
     			?></td>
-    			
+
     			<td class="jLastStatusText">
     			    <?=$j->getJobLastStatusText()?>
                 </td>
-    			
+
     			<td class="ccm-jobs-button">
     				<button data-jID="<?=$j->getJobID()?>" data-jSupportsQueue="<?=$j->supportsQueue()?>" data-jName="<?=$j->getJobName()?>" class="btn-run-job btn btn-default btn-xs"><i class="fa fa-play"></i> <?=t('Run')?></button>
     			</td>
-    			
+
     			<td style="width: 50px">
     				<a href="javascript:void(0)" class="ccm-automate-job-instructions icon-link launch-tooltip" data-jSupportsQueue="<?=$j->supportsQueue()?>" data-jID="<?=$j->getJobID()?>" title="<?=t('Automate this Job')?>"><i class="fa fa-clock-o"></i></a>
     				<? if ($j->canUninstall()) { ?>
-    					<a href="<?=$view->action('uninstall', $j->getJobID())?>" class="icon-link launch-tooltip" title="<?=t('Remove this Job')?>"><i class="fa fa-trash-o"></i></a>
+    					<a href="<?=$view->action('uninstall', $j->getJobID(), $uninstallToken)?>" class="icon-link launch-tooltip" title="<?=t('Remove this Job')?>"><i class="fa fa-trash-o"></i></a>
     				<? } ?>
     			</td>
-    			
+
     		</tr>
     	<? } ?>
 	</tbody>
@@ -107,27 +110,28 @@
     <? foreach($installedJobs as $j) { ?>
     	<div id="jd<?=$j->getJobID()?>" class="ccm-ui">
     		<form action="<?=$view->action('update_job_schedule')?>" method="post" data-schedule-form="<?=$j->getJobID()?>">
+				<?php $token->output('update_job_schedule') ?>
     			<?=$form->hidden('jID', $j->getJobID());?>
-    			
+
     			<h4><?=t('Run Job')?></h4>
-    			
+
     			<div class="radio">
     			    <label>
         			    <input type="radio" name="isScheduled" class="ccm-jobs-automation-schedule-type" value="1" <?=($j->isScheduled?'checked="checked"':'')?> />
         				<?=t('When people browse to the page.  (which runs after the main rendering request of the page.)')?>
     			    </label>
     			</div>
-    			
+
     			<fieldset class="ccm-jobs-automation-schedule-auto" <?=($j->isScheduled?'':'style="display: none;"')?>>
     				<div class="well clearfix">
     				    <div class="form-group">
     					    <label><?php  echo t('Run this Job Every')?></label>
-    						
+
     						<div class="input">
     						    <div class="col-md-6">
     							    <?php echo $form->text('value',h($j->scheduledValue),array('class'=>''))?>
     						    </div>
-    						    
+
     						    <div class="col-md-6">
     						        <?php echo $form->select('unit', array('minutes' => t('Minutes'), 'hours'=>t('Hours'), 'days'=>t('Days'), 'weeks'=>t('Weeks'), 'months'=>t('Months')), h($j->scheduledInterval), array('class'=>''))?>
     						    </div>
@@ -135,56 +139,56 @@
     				    </div>
     				</div>
     			</fieldset>
-    			
+
     			<div class="radio">
     			    <label>
         			    <input type="radio" name="isScheduled" class="ccm-jobs-automation-schedule-type" value="0" <?=($j->isScheduled?'':'checked="checked"')?> />
                         <?=t('Through Cron')?>
     			    </label>
     			</div>
-    			
+
     			<fieldset class="ccm-jobs-automation-schedule-cron" <?=($j->isScheduled?'style="display: none;"':'')?>>
     				<div class="well">
     					<? if ($j->supportsQueue()) { ?>
     						<p><?=t('The "%s" job supports queueing, meaning it can be run in a couple different ways:', $j->getJobName())?></p>
-    						
+
     						<h4><?=t('No Queueing')?></h4>
-    						
+
     						<div class="form-group">
     						    <textarea rows="2" class="ccm-default-jobs-url form-control"><?=URL::to('/ccm/system/jobs?auth=' . $auth . '&jID=' . $j->getJobID())?></textarea>
                             </div>
-                            
+
     						<div class="alert alert-info">
     						    <?=t('This will treat the job as though it were like any other concrete5 job. The entire job will be run at once.')?>
                             </div>
-    			
+
     						<h4><?=t('Queueing')?></h4>
-    						
+
     						<p><?=t("First, schedule this URL for when you'd like this job to run:")?></p>
-    						
+
     						<div class="form-group">
     						    <textarea rows="2" class="ccm-default-jobs-url form-control"><?php echo URL::to('/ccm/system/jobs/run_single?auth=' . $auth . '&jID=' . $j->getJobID())?></textarea>
                             </div>
-                            
+
     						<p><?=t('Then, make sure this URL is scheduled to run frequently, like every 3-5 minutes:')?></p>
-    						
+
     						<div class="form-group">
     						    <textarea rows="2" class="ccm-default-jobs-url form-control"><?=URL::to('/ccm/system/jobs/check_queue?auth=' . $auth)?></textarea>
     						</div>
-    						
+
     						<div class="alert alert-info">
     						    <?=t('The first URL starts the process - the second ensures that it completes in batches.')?>
                             </div>
-    			
+
     					<? } else { ?>
     						<p><?=t('To run the "%s" job, automate the following URL using cron or a similar system:', $j->getJobName())?></p><br/>
     						<div>
     						    <textarea rows="2" class="ccm-default-jobs-url form-control"><?=URL::to('/ccm/system/jobs/run_single?auth=' . $auth . '&jID=' . $j->getJobID())?></textarea>
                             </div>
-    					<? } ?>	
+    					<? } ?>
     				</div>
     			</fieldset>
-    			
+
     			<div class="dialog-buttons">
                     <button type="button" onclick="$('form[data-schedule-form=<?=$j->getJobID()?>]').submit()" class="btn btn-primary pull-right">
                         <?=t('Save')?>
@@ -203,26 +207,26 @@
 	<h4><?=t('Awaiting Installation')?></h4>
 	<table class="table table-striped">
 	<thead>
-		<tr> 
+		<tr>
 			<th><?=t('Name')?></th>
-			<th><?=t('Description')?></th> 
+			<th><?=t('Description')?></th>
 			<th></th>
 		</tr>
 	</thead>
 	<tbody>
 		<?foreach($availableJobs as $availableJobName => $job):?>
-    		<tr> 
+    		<tr>
     			<td><?=$job->getJobName() ?></td>
-    			<td><?=$job->getJobDescription() ?></td> 
+    			<td><?=$job->getJobDescription() ?></td>
     			<td><?if(!$job->invalid):?>
     				<a href="<?=$view->action('install', $job->jHandle)?>" class="btn btn-sm btn-default pull-right"><?=t('Install')?></a>
     			<?endif?></td>
-    		</tr>	
+    		</tr>
 		<?endforeach?>
 	</tbody>
 	</table>
 <? } ?>
-<? 
+<?
 $djs = JobSet::getDefault();
 if (is_object($djs)) { ?>
 <div class="well">
@@ -242,25 +246,25 @@
 
 <?php if (in_array($this->controller->getTask(), array('update_set', 'update_set_jobs', 'edit_set', 'delete_set'))) { ?>
 	<h2><?=$set->getJobSetName()?></h2>
-	
+
 	<div class="row">
 	    <div class="col-md-6">
             <form class="form-vertical" method="post" action="<?php echo $view->action('update_set')?>">
-		
+
                 <input type="hidden" name="jsID" value="<?php echo $set->getJobSetID()?>" />
 
                 <?php echo Loader::helper('validation/token')->output('update_set')?>
 
         		<fieldset>
         			<legend><?=t('Details')?></legend>
-        
+
         			<div class="form-group">
         				<?php echo $form->label('jsName', t('Name'))?>
         				<div class="input">
         					<?php echo $form->text('jsName', $set->getJobSetName())?>
         				</div>
         			</div>
-    
+
         			<div class="form-group">
         				<div class="input">
         				    <button type="submit" class="btn btn-primary"><?=t('Update Job Set')?></button>
@@ -270,16 +274,16 @@
             </form>
 
     		<? if ($set->canDelete()) { ?>
-    
+
         		<form method="post" action="<?php echo $view->action('delete_set')?>" class="form-vertical">
             		<fieldset>
             			<legend><?=t('Delete Set')?></legend>
-            			
+
             			<?php echo Loader::helper('validation/token')->output('delete_set')?>
             			<input type="hidden" name="jsID" value="<?php echo $set->getJobSetID()?>" />
-            			
+
             			<p><?php echo t('Warning, this cannot be undone. No jobs will be deleted but they will no longer be grouped together.')?></p>
-                		
+
                 		<div class="form-group">
             				<div class="input">
             				    <button type="submit" class="btn btn-primary"><?=t('Delete Job Set')?></button>
@@ -297,8 +301,8 @@
 
                 <fieldset>
                     <legend><?=t('Jobs')?></legend>
-		
-        			<?php 
+
+        			<?php
         			$list = $set->getJobs();
         			if (count($installedJobs) > 0) { ?>
                         <?php foreach($installedJobs as $g) {  ?>
@@ -306,11 +310,11 @@
     							<label>
     							    <?php echo $form->checkbox('jID[]', $g->getJobID(), $set->contains($g)) ?>
                                     <span><?php echo $g->getJobName()?></span>
-    							
+
     							</label>
                             </div>
                         <?php } ?>
-        				
+
                         <div class="form-group">
             				<div class="input">
             				    <button type="submit" class="btn btn-primary"><?=t('Update Jobs')?></button>
@@ -330,8 +334,9 @@
         <div class="col-md-12">
             <div class="well">
 		        <h4><?=t('Automation Instructions')?></h4>
-            
+
                 <form action="<?=$view->action('update_set_schedule');?>" method="post">
+					<?php $token->output('update_set_schedule'); ?>
 			        <?=$form->hidden('jsID',$set->getJobSetID()); ?>
                     <div class="radio">
                         <label>
@@ -339,7 +344,7 @@
                             <?=t('When people browse to the page.  (which runs after the main rendering request of the page.)')?>
                         </label>
                     </div>
-                
+
                     <fieldset class="ccm-jobs-automation-schedule-auto" <?=($set->isScheduled?'':'style="display: none;"')?>>
     				    <div class="col-md-3">
         				    <div class="form-group">
@@ -349,7 +354,7 @@
             					</div>
         				    </div>
     				    </div>
-    				    
+
     				    <div class="col-md-3">
     				        <div class="form-group">
     				            <label></label>
@@ -359,22 +364,22 @@
     				        </div>
     				    </div>
                     </fieldset>
-		
+
                     <div class="radio">
                         <label>
                             <input type="radio" name="isScheduled" class="ccm-jobs-automation-schedule-type" value="0" <?=($set->isScheduled?'':'checked="checked"')?> />
                             <?=t('Through Cron')?>
                         </label>
                     </div>
-    			
+
                     <fieldset class="ccm-jobs-automation-schedule-cron" <?=($set->isScheduled?'style="display: none;"':'')?>>
     				    <p><?=t('To run all the jobs in this Job Set, schedule this URL using cron or a similar system:', $set->getJobSetID())?></p>
-    				
+
                         <div class="form-group">
                             <textarea rows="2" class="ccm-default-jobs-url form-control"><?=$view->url('/tools/required/jobs?auth=' . $auth . '&jsID=' . $set->getJobSetID())?></textarea>
                         </div>
                     </fieldset>
-    			
+
     			<div class="form-group">
     				<?php echo $form->submit('submit', t('Update Schedule'), array('class' => 'btn-primary'))?>
     			</div>
@@ -401,11 +406,11 @@
         	<?php } else { ?>
         		<p><?php echo t('You have not added any Job sets.')?></p>
         	<?php } ?>
-    
+
             <br/>
-    	
+
             <h3><?=t('Add Set')?></h3>
-    
+
         	<?php echo Loader::helper('validation/token')->output('add_set')?>
         	<div class="form-group">
         		<?php echo $form->label('jsName', t('Name'))?>
@@ -413,7 +418,7 @@
         			<?php echo $form->text('jsName')?>
         		</div>
         	</div>
-        	
+
         	<div class="form-group">
         		<label><?=t('Jobs')?></label>
         		<?php foreach($installedJobs as $g) {  ?>
@@ -425,11 +430,11 @@
                     </div>
                 <?php } ?>
         	</div>
-        	
+
         	<div class="well clearfix">
         	    <button type="submit" class="btn btn-primary pull-right"><?=t('Add Job Set')?></button>
         	</div>
-        	
+
         </form>
     </div>
 </div>
@@ -462,7 +467,7 @@
 		} else {
 			row.find('td').css('background-color', '#ccc');
 			row.attr('data-color', '#ccc');
-		}			
+		}
 	}, 500);
 }
 
@@ -523,7 +528,7 @@
 				}
 			);
 		} else {
-			$.ajax({ 
+			$.ajax({
 				url: '<?php echo addslashes(URL::to('/ccm/system/jobs/run_single'))?>',
 				data: params,
 				dataType: 'json',
@@ -534,7 +539,7 @@
 			});
 		}
 	});
-	
+
 	$('.ccm-jobs-automation-schedule-type').click(function() {
 		if($(this).val() == 1) {
 			$(this).parent().parent().siblings('.ccm-jobs-automation-schedule-cron').hide();
@@ -545,4 +550,4 @@
 		}
 	});
 });
-</script>
\ No newline at end of file
+</script>
diff --git a/web/concrete/single_pages/dashboard/system/seo/bulk.php b/web/concrete/single_pages/dashboard/system/seo/bulk.php
index 6de70b9b3c9..3a84b98236b 100644
--- a/web/concrete/single_pages/dashboard/system/seo/bulk.php
+++ b/web/concrete/single_pages/dashboard/system/seo/bulk.php
@@ -191,6 +191,7 @@
                         <? } ?>
                         <div class="form-group submit-changes">
                             <form id="seoForm<?php echo $cID; ?>" action="<?php echo View::url('/dashboard/system/seo/page_data/', 'saveRecord')?>" method="post" class="pageForm">
+                                <?php $token->output('save_seo_record_' . $cobj->getCollectionID()) ?>
                                 <a class="btn btn-default submit-changes" data-cID="<?php echo $cobj->getCollectionID() ?>"><?php echo t('Save') ?></a>
                             </form>
                             <img style="display: none; position: absolute; top: 20px; right: 20px;" id="throbber<?php echo $cID ?>"  class="throbber" src="<?php echo ASSETS_URL_IMAGES . '/throbber_white_32.gif' ?>" />
@@ -225,7 +226,7 @@
                 data.meta_title = $('.ccm-seoRow-'+iterator+' input[name="meta_title"].hasChanged').val();
                 data.meta_description = $('.ccm-seoRow-'+iterator+' textarea[name="meta_description"]').val();
                 data.collection_handle = $('.ccm-seoRow-'+iterator+' input[name="collection_handle"]').val();
-
+                data.ccm_token = $('.ccm-seoRow-'+iterator+' input[name="ccm_token"]').val();
                 $.ajax({
                     url: '<?php echo $view->action("saveRecord") ?>',
                     dataType: 'json',
@@ -239,6 +240,8 @@
                             $('.ccm-seoRow-'+cID+' .collectionHandle').val(res.cHandle);
                             $('.hasChanged').removeClass('.hasChanged');
                             $('.btn-success').removeClass('btn-success');
+                        } else if (res.message) {
+                            alert(res.message);
                         } else {
                             alert('<?php echo t('An error occured while saving.'); ?>');
                         }
diff --git a/web/concrete/tools/files/permissions.php b/web/concrete/tools/files/permissions.php
index 99b8de595db..04830b0056c 100644
--- a/web/concrete/tools/files/permissions.php
+++ b/web/concrete/tools/files/permissions.php
@@ -5,8 +5,11 @@
 
 $u = new User();
 $form = Loader::helper('form');
-$ih = Loader::helper('concrete/ui'); 
-$f = File::getByID($_REQUEST['fID']);
+$ih = Loader::helper('concrete/ui');
+$fileID = $_REQUEST['fID'];
+$f = File::getByID($fileID);
+$token = Core::make('token');
+
 $cp = new Permissions($f);
 if (!$cp->canAdmin()) {
 	die(t("Access Denied."));
@@ -17,6 +20,10 @@
 $r->setFile($f);
 
 if ($_POST['task'] == 'set_password') {
+	if (!$token->validate('set_password_' . $fileID)) {
+		die(t('Invalid CSRF Token.'));
+	}
+
 	$f->setPassword($_POST['fPassword']);
 	$r->setMessage(t('File password saved successfully.'));
 	$r->outputJSON();
@@ -25,6 +32,9 @@
 
 
 if ($_POST['task'] == 'set_location') {
+	if (!$token->validate('set_location_' . $fileID)) {
+		die(t('Invalid CSRF Token.'));
+	}
     $fsl = FileStorageLocation::getByID($_POST['fslID']);
     if (is_object($fsl)) {
         try {
@@ -73,6 +83,9 @@
 <p><?=t('Leave the following form field blank in order to allow everyone to download this file.')?></p>
 
 <form method="post" data-dialog-form="file-password" action="<?=Loader::helper('concrete/urls')->getToolsURL('files/permissions')?>">
+	<?php
+	$token->output('set_password_' . $f->getFileID());
+	?>
 <?=$form->hidden('task', 'set_password')?>
 <?=$form->hidden('fID', $f->getFileID())?>
 <?=$form->text('fPassword', $f->getPassword(), array('style' => 'width: 250px'))?>
@@ -97,6 +110,9 @@
 <form method="post" data-dialog-form="file-storage" action="<?=Loader::helper('concrete/urls')->getToolsURL('files/permissions')?>">
 <div class="help-block"><p><?=t('All versions of a file will be moved to the selected location.')?></p></div>
 
+	<?php
+	$token->output('set_location_' . $f->getFileID());
+	?>
 <?=$form->hidden('task', 'set_location')?>
 <?=$form->hidden('fID', $f->getFileID())?>
 <?
@@ -119,7 +135,7 @@
 </div>
 
 <script type="text/javascript">
-	
+
 $("#ccm-file-permissions-tabs a").click(function() {
 	$("li.active").removeClass('active');
 	$("#" + ccm_fpActiveTab + "-tab").hide();
@@ -154,5 +170,5 @@
 	ccm_filePermissionsSetupButtons();
 	//$('form[data-dialog-form=file-storage],form[data-dialog-form=file-password]').concreteAjaxForm();
 });
-	
+
 </script>