diff --git a/web/handlers/http.go b/web/handlers/http.go
index 5540a6a..4558e93 100644
--- a/web/handlers/http.go
+++ b/web/handlers/http.go
@@ -204,6 +204,7 @@ func New(
 	}
 
 	CSRF := csrf.Protect(csrfKey,
+		csrf.Path("/"),
 		csrf.ErrorHandler(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			err := csrf.FailureReason(req)
 			// TODO: localize error?